CVE-2022-3203 (GCVE-0-2022-3203)

Vulnerability from cvelistv5 – Published: 2022-10-21 12:30 – Updated: 2025-05-07 14:06
VLAI?
Summary
On ORing net IAP-420(+) with FW version 2.0m a telnet server is enabled by default and cannot permanently be disabled. You can connect to the device via LAN or WiFi with hardcoded credentials and get an administrative shell. These credentials are reset to defaults with every reboot.
Severity ?
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
Assigner
References
Impacted products
Vendor Product Version
ORing IAP-420(+) Affected: FW 2.0m
Create a notification for this product.
Credits
Lorenzo Bazzana and Marino Miculan of Università degli studi di Udine, Michele Codutti of Danieli Automation
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T01:00:10.865Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://mads.uniud.it/2022/09/lord-of-the-orings/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-3203",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-07T14:06:15.814773Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-07T14:06:37.577Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "IAP-420(+)",
          "vendor": "ORing",
          "versions": [
            {
              "status": "affected",
              "version": "FW 2.0m"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Lorenzo Bazzana and Marino Miculan of Universit\u00e0 degli studi di Udine, Michele Codutti of Danieli Automation"
        }
      ],
      "datePublic": "2022-10-21T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "On ORing net IAP-420(+) with FW version 2.0m a telnet server is enabled by default and cannot permanently be disabled. You can connect to the device via LAN or WiFi with hardcoded credentials and get an administrative shell. These credentials are reset to defaults with every reboot."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-912",
              "description": "CWE-912 Hidden Functionality",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-11-02T00:00:00.000Z",
        "orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
        "shortName": "CERTVDE"
      },
      "references": [
        {
          "url": "https://mads.uniud.it/2022/09/lord-of-the-orings/"
        }
      ],
      "source": {
        "defect": [
          "CERT@VDE#64203"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "ORing net  IAP-420(+) Hidden Functionality",
      "workarounds": [
        {
          "lang": "en",
          "value": "After every reboot telnet to the device and terminate the telnetd process (at least)"
        }
      ],
      "x_generator": {
        "engine": "vulnogram 0.1.0-rc1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
    "assignerShortName": "CERTVDE",
    "cveId": "CVE-2022-3203",
    "datePublished": "2022-10-21T12:30:12.353Z",
    "dateReserved": "2022-09-13T00:00:00.000Z",
    "dateUpdated": "2025-05-07T14:06:37.577Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:oringnet:iap-420\\\\+_firmware:2.0m:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"AF635AF4-76E5-4BED-BBD6-8E359D90A360\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:oringnet:iap-420\\\\+:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0D40FEDC-0DFC-4790-A906-05ACEC686B9A\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:oringnet:iap-420_firmware:2.0m:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0D2DDA93-3EF0-487D-B031-242021E19623\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:oringnet:iap-420:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"11AA2B35-558A-4094-96FD-5A96F5B3B845\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"On ORing net IAP-420(+) with FW version 2.0m a telnet server is enabled by default and cannot permanently be disabled. You can connect to the device via LAN or WiFi with hardcoded credentials and get an administrative shell. These credentials are reset to defaults with every reboot.\"}, {\"lang\": \"es\", \"value\": \"En ORing net IAP-420(+) con FW versi\\u00f3n 2.0m, un servidor telnet est\\u00e1 habilitado por defecto y no puede ser deshabilitado permanentemente. Puede conectarse al dispositivo con credenciales embebidas y conseguir un shell administrativo. Estas credenciales son restablecidas a valores predeterminados con cada reinicio\"}]",
      "id": "CVE-2022-3203",
      "lastModified": "2024-11-21T07:19:02.473",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"info@cert.vde.com\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 5.9}, {\"source\": \"nvd@nist.gov\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 5.9}]}",
      "published": "2022-10-21T13:15:09.593",
      "references": "[{\"url\": \"https://mads.uniud.it/2022/09/lord-of-the-orings/\", \"source\": \"info@cert.vde.com\", \"tags\": [\"Exploit\", \"Mitigation\", \"Third Party Advisory\"]}, {\"url\": \"https://mads.uniud.it/2022/09/lord-of-the-orings/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Mitigation\", \"Third Party Advisory\"]}]",
      "sourceIdentifier": "info@cert.vde.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"info@cert.vde.com\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-912\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-3203\",\"sourceIdentifier\":\"info@cert.vde.com\",\"published\":\"2022-10-21T13:15:09.593\",\"lastModified\":\"2024-11-21T07:19:02.473\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"On ORing net IAP-420(+) with FW version 2.0m a telnet server is enabled by default and cannot permanently be disabled. You can connect to the device via LAN or WiFi with hardcoded credentials and get an administrative shell. These credentials are reset to defaults with every reboot.\"},{\"lang\":\"es\",\"value\":\"En ORing net IAP-420(+) con FW versi\u00f3n 2.0m, un servidor telnet est\u00e1 habilitado por defecto y no puede ser deshabilitado permanentemente. Puede conectarse al dispositivo con credenciales embebidas y conseguir un shell administrativo. Estas credenciales son restablecidas a valores predeterminados con cada reinicio\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"info@cert.vde.com\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"info@cert.vde.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-912\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:oringnet:iap-420\\\\+_firmware:2.0m:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AF635AF4-76E5-4BED-BBD6-8E359D90A360\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:oringnet:iap-420\\\\+:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0D40FEDC-0DFC-4790-A906-05ACEC686B9A\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:oringnet:iap-420_firmware:2.0m:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0D2DDA93-3EF0-487D-B031-242021E19623\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:oringnet:iap-420:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"11AA2B35-558A-4094-96FD-5A96F5B3B845\"}]}]}],\"references\":[{\"url\":\"https://mads.uniud.it/2022/09/lord-of-the-orings/\",\"source\":\"info@cert.vde.com\",\"tags\":[\"Exploit\",\"Mitigation\",\"Third Party Advisory\"]},{\"url\":\"https://mads.uniud.it/2022/09/lord-of-the-orings/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Mitigation\",\"Third Party Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://mads.uniud.it/2022/09/lord-of-the-orings/\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-03T01:00:10.865Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-3203\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-05-07T14:06:15.814773Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-05-07T14:06:26.572Z\"}}], \"cna\": {\"title\": \"ORing net  IAP-420(+) Hidden Functionality\", \"source\": {\"defect\": [\"CERT@VDE#64203\"], \"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"value\": \"Lorenzo Bazzana and Marino Miculan of Universit\\u00e0 degli studi di Udine, Michele Codutti of Danieli Automation\"}], \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 9.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"ORing\", \"product\": \"IAP-420(+)\", \"versions\": [{\"status\": \"affected\", \"version\": \"FW 2.0m\"}]}], \"datePublic\": \"2022-10-21T00:00:00.000Z\", \"references\": [{\"url\": \"https://mads.uniud.it/2022/09/lord-of-the-orings/\"}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"After every reboot telnet to the device and terminate the telnetd process (at least)\"}], \"x_generator\": {\"engine\": \"vulnogram 0.1.0-rc1\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"On ORing net IAP-420(+) with FW version 2.0m a telnet server is enabled by default and cannot permanently be disabled. You can connect to the device via LAN or WiFi with hardcoded credentials and get an administrative shell. These credentials are reset to defaults with every reboot.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-912\", \"description\": \"CWE-912 Hidden Functionality\"}]}], \"providerMetadata\": {\"orgId\": \"270ccfa6-a436-4e77-922e-914ec3a9685c\", \"shortName\": \"CERTVDE\", \"dateUpdated\": \"2022-11-02T00:00:00.000Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-3203\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-07T14:06:37.577Z\", \"dateReserved\": \"2022-09-13T00:00:00.000Z\", \"assignerOrgId\": \"270ccfa6-a436-4e77-922e-914ec3a9685c\", \"datePublished\": \"2022-10-21T12:30:12.353Z\", \"assignerShortName\": \"CERTVDE\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.