CVE-2022-43308 : INTELBRAS SG 2404 MR 20180928-rel64938 allows authenticated attackers to arbitra

INTELBRAS SG 2404 MR 20180928-rel64938 allows authenticated attackers to arbitrarily create Administrator accounts via crafted user cookies.

Published 2022-11-18 04:15:17

Updated 2022-11-23 18:07:36

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2022-43308

Intelbras » Sg 2404 Poe Firmware » Version: N/A
cpe:2.3:o:intelbras:sg_2404_poe_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Intelbras » Sg 2404 Poe » Version: N/A
Intelbras » Sg 2404 Mr Firmware » Version: N/A
cpe:2.3:o:intelbras:sg_2404_mr_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Intelbras » Sg 2404 Mr » Version: N/A

EPSS FAQ

0.05%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 18 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	1.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE-269 Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Assigned by: nvd@nist.gov (Primary)

Jump to