CVE-2022-47037 - OpenCVE

Siklu TG Terragraph devices before 2.1.1 allow attackers to discover valid, randomly generated credentials via GetCredentials.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

Vendors & Products
CPE Configurations

Vendors	Products
Siklu	Tg N265 Tg Mpl-261 Tg T261 Tg T265 Tg N366 Tg Lr T280 Tg N367 Tg T260 Tg Firmware

Configuration 1 [-]

AND

cpe:2.3:o:siklu:tg_firmware:*:*:*:*:*:*:*:*

OR	cpe:2.3:h:siklu:tg_lr_t280:-:::::::*
	cpe:2.3:h:siklu:tg_mpl-261:-:::::::*
	cpe:2.3:h:siklu:tg_n265:-:::::::*
	cpe:2.3:h:siklu:tg_n366:-:::::::*
	cpe:2.3:h:siklu:tg_n367:-:::::::*
	cpe:2.3:h:siklu:tg_t260:-:::::::*
	cpe:2.3:h:siklu:tg_t261:-:::::::*
	cpe:2.3:h:siklu:tg_t265:-:::::::*

References

Link	Resource
https://semaja2.net/2023/06/11/siklu-tg-auth-bypass.html	Exploit Third Party Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: mitre

Published: 2024-03-18T00:00:00

Updated: 2024-03-18T03:05:14.435629

Reserved: 2022-12-12T00:00:00

Link: CVE-2022-47037

JSON object: View

NVD Information

Status : Analyzed

Published: 2024-03-18T03:15:06.017

Modified: 2024-04-08T22:38:15.457

Link: CVE-2022-47037

JSON object: View

Redhat Information

No data.

CWE

CWE-522

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:siklu:tg_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "50DC665C-789B-468F-8BC2-DDC17AD47EC1", "versionEndExcluding": "2.1.1", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:siklu:tg_lr_t280:-:*:*:*:*:*:*:*", "matchCriteriaId": "11E8403D-DB00-49D9-B31B-4DD3773E3DEA", "vulnerable": false}, {"criteria": "cpe:2.3:h:siklu:tg_mpl-261:-:*:*:*:*:*:*:*", "matchCriteriaId": "62ED75AA-DB96-449A-951E-D9F475DDE44C", "vulnerable": false}, {"criteria": "cpe:2.3:h:siklu:tg_n265:-:*:*:*:*:*:*:*", "matchCriteriaId": "E76E7BBE-005B-4763-B6B5-258D6425DC90", "vulnerable": false}, {"criteria": "cpe:2.3:h:siklu:tg_n366:-:*:*:*:*:*:*:*", "matchCriteriaId": "06C9F704-DA9D-4566-9C0C-B5E0E44E0EBC", "vulnerable": false}, {"criteria": "cpe:2.3:h:siklu:tg_n367:-:*:*:*:*:*:*:*", "matchCriteriaId": "0D7AF7EA-9ABC-470A-B1D7-BA36F5045849", "vulnerable": false}, {"criteria": "cpe:2.3:h:siklu:tg_t260:-:*:*:*:*:*:*:*", "matchCriteriaId": "B237F83B-6E14-4E94-969D-6640BEFDF2D8", "vulnerable": false}, {"criteria": "cpe:2.3:h:siklu:tg_t261:-:*:*:*:*:*:*:*", "matchCriteriaId": "6951CD15-EA5B-4EFC-B3C1-FD803A4D0579", "vulnerable": false}, {"criteria": "cpe:2.3:h:siklu:tg_t265:-:*:*:*:*:*:*:*", "matchCriteriaId": "0A4DB8EE-898C-443D-A687-D934D2671B9C", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "Siklu TG Terragraph devices before 2.1.1 allow attackers to discover valid, randomly generated credentials via GetCredentials."}, {"lang": "es", "value": "Los dispositivos Siklu TG Terragraph anteriores a 2.1.1 permiten a los atacantes descubrir credenciales v\u00e1lidas generadas aleatoriamente a trav\u00e9s de GetCredentials."}], "id": "CVE-2022-47037", "lastModified": "2024-04-08T22:38:15.457", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-03-18T03:15:06.017", "references": [{"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://semaja2.net/2023/06/11/siklu-tg-auth-bypass.html"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-522"}], "source": "nvd@nist.gov", "type": "Primary"}]}