CVE-2022-33106 Auth bypass in n/a
Attackers can brute force admin passwords due to missing rate limits, leading to full account takeover of the network firewall.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-33106?
CVE-2022-33106 is a critical authentication bypass vulnerability in n/a, published on 12 Oct 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
WiJungle NGFW Version U250 was discovered to be vulnerable to No Rate Limit attack, allowing the attacker to brute force the admin password leading to Account Take Over.
Weakness: CWE-307
Which versions are affected by CVE-2022-33106?
It affects 1 product.
Products include Wijungle U250 Firmware.
How do I fix CVE-2022-33106?
No fix has been published for CVE-2022-33106 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2022-33106 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-33106 exists.
Sources
Also known as GHSA-c4hc-pv5q-j9xp.