CVE-2022-32985 Hardcoded credentials in n/a
A hardcoded backdoor account allows unauthorized SSH access to Nexans FTTO GigaSwitch devices, enabling full system compromise.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-32985?
CVE-2022-32985 is a critical vulnerability in n/a, published on 17 Jul 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
libnx_apl.so on Nexans FTTO GigaSwitch before 6.02N and 7.x before 7.02 implements a Backdoor Account for SSH logins on port 50200 or 50201.
Weakness: CWE-798
Which versions are affected by CVE-2022-32985?
It affects 13 products.
Products include Nexans Gigaswitch 641 Desk V5 Sfp-Vi Firmware, Nexans Gigaswitch 642 Desk V5 Sfp-2vi Firmware, Nexans Gigaswitch V5 2tp\(pd-F\+\) Sfp-Vi 54vdc Firmware, Nexans Gigaswitch V5 2tp\(pse\+\) Sfp-Vi 54vdc Firmware, Nexans Gigaswitch V5 2tp Sfp-Vi 54vdc Firmware, Nexans Gigaswitch V5 Sfp-2vi 230vac Firmware and 7 more.
How do I fix CVE-2022-32985?
No fix has been published for CVE-2022-32985 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-32985 being exploited?
There is no known exploitation of CVE-2022-32985 in the wild and no public exploit code.
Sources
Also known as GHSA-5rg4-g8rc-v2hx.