CVE-2022-43470 Cross-site request forgery in +F FS040U, +F FS020W, +F FS030W, and +F FS040W
An adjacent attacker can hijack administrator sessions to reboot devices or reset configurations via CSRF in Fuji Soft routers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-43470?
CVE-2022-43470 is a high-severity vulnerability in FUJI SOFT INCORPORATED +F FS040U, +F FS020W, +F FS030W, and +F FS040W, published on 5 Dec 2022. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Cross-site request forgery (CSRF) vulnerability in +F FS040U software versions v2.3.4 and earlier, +F FS020W software versions v4.0.0 and earlier, +F FS030W software versions v3.3.5 and earlier, and +F FS040W software versions v1.4.1 and earlier allows an adjacent attacker to hijack the authentication of an administrator and user's unintended operations such as to reboot the product and/or reset the configuration to the initial set-up may be performed.
Weakness: CWE-352
Which versions are affected by CVE-2022-43470?
It affects 4 products.
Products include Fsi Fs020w Firmware, Fsi Fs030w Firmware, Fsi Fs040u Firmware, Fsi Fs040w Firmware.
How do I fix CVE-2022-43470?
No fix has been published for CVE-2022-43470 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-43470 being exploited?
There is no known exploitation of CVE-2022-43470 in the wild and no public exploit code.
Sources
Also known as GHSA-m554-rhfc-2hcg.