CVE-2022-40903 - OpenCVE

Aiphone GT-DMB-N 3-in-1 Video Entrance Station with NFC Reader 1.0.3 does not mitigate against repeated failed access attempts, which allows an attacker to gain administrative privileges.

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

Vendors & Products
CPE Configurations

Vendors	Products
Aiphone	Gt-dmb Gt-db-vn Firmware Gt-dmb-lvn Gt-dmb-n Firmware Gt-dmb-n Gt-db-vn Gt-dmb Firmware Gt-dmb-lvn Firmware

Configuration 1 [-]

AND

cpe:2.3:o:aiphone:gt-dmb-n_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:aiphone:gt-dmb-n:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:aiphone:gt-dmb_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:aiphone:gt-dmb:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:aiphone:gt-dmb-lvn_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:aiphone:gt-dmb-lvn:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND

cpe:2.3:o:aiphone:gt-db-vn_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:aiphone:gt-db-vn:-:*:*:*:*:*:*:*

References

Link	Resource
https://jvn.jp/en/jp/JVN75437943/index.html	Third Party Advisory VDB Entry
https://www.aiphone.net/	Vendor Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: mitre

Published: 2022-11-14T00:00:00

Updated: 2022-11-14T00:00:00

Reserved: 2022-09-19T00:00:00

Link: CVE-2022-40903

JSON object: View

NVD Information

Status : Analyzed

Published: 2022-11-14T23:15:11.657

Modified: 2022-11-22T17:16:23.447

Link: CVE-2022-40903

JSON object: View

Redhat Information

No data.

CWE

NVD-CWE-noinfo

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:aiphone:gt-dmb-n_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "F6D30440-5146-487B-9E8B-C7158C77A08D", "versionEndExcluding": "3.00", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:aiphone:gt-dmb-n:-:*:*:*:*:*:*:*", "matchCriteriaId": "0AB295CF-BCDE-4AD7-9B9A-405A80DDF2BE", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:aiphone:gt-dmb_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "D496A08F-D301-45C4-8D7E-EA56BCCBFBBE", "versionEndExcluding": "3.00", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:aiphone:gt-dmb:-:*:*:*:*:*:*:*", "matchCriteriaId": "DE4BFBE3-975D-4604-BD00-D979179919BC", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:aiphone:gt-dmb-lvn_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "891D2AC0-53E7-4ABE-B9FC-9CE4CD05C249", "versionEndExcluding": "3.00", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:aiphone:gt-dmb-lvn:-:*:*:*:*:*:*:*", "matchCriteriaId": "DE20C953-30DB-4A6D-8926-2A4958CBB753", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:aiphone:gt-db-vn_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "226D2E6E-FF2B-4EE5-A416-B2FD1795DC0E", "versionEndExcluding": "2.00", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:aiphone:gt-db-vn:-:*:*:*:*:*:*:*", "matchCriteriaId": "652A6388-F059-4A14-8D7E-EC59892EAD48", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "Aiphone GT-DMB-N 3-in-1 Video Entrance Station with NFC Reader 1.0.3 does not mitigate against repeated failed access attempts, which allows an attacker to gain administrative privileges."}, {"lang": "es", "value": "La estaci\u00f3n de entrada de v\u00eddeo 3 en 1 Aiphone GT-DMB-N con lector NFC 1.0.3 no mitiga los repetidos intentos fallidos de acceso, lo que permite a un atacante obtener privilegios administrativos."}], "id": "CVE-2022-40903", "lastModified": "2022-11-22T17:16:23.447", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-11-14T23:15:11.657", "references": [{"source": "cve@mitre.org", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://jvn.jp/en/jp/JVN75437943/index.html"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://www.aiphone.net/"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}