Vulnerability Description
Authentication bypass in Netcomm router models NF20MESH, NF20, and NL1902 allows an unauthenticated user to access content. In order to serve static content, the application performs a check for the existence of specific characters in the URL (.css, .png etc). If it exists, it performs a "fake login" to give the request an active session to load the file and not redirect to the login page.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Netcommwireless | Nf20 Firmware | < r6b025 |
| Netcommwireless | Nf20 | - |
| Netcommwireless | Nf20Mesh Firmware | < r6b025 |
| Netcommwireless | Nf20Mesh | - |
| Netcommwireless | Nl1902 Firmware | < r6b025 |
| Netcommwireless | Nl1902 | - |
Related Weaknesses (CWE)
References
- https://github.com/scarvell/advisories/blob/main/2022_netcomm_nf20mesh_unauth_rcExploitThird Party Advisory
- https://github.com/scarvell/advisories/blob/main/2022_netcomm_nf20mesh_unauth_rcExploitThird Party Advisory
- https://www.kb.cert.org/vuls/id/986018
FAQ
What is CVE-2022-4874?
CVE-2022-4874 is a vulnerability with a CVSS score of 7.5 (HIGH). Authentication bypass in Netcomm router models NF20MESH, NF20, and NL1902 allows an unauthenticated user to access content. In order to serve static content, the application performs a check for the e...
How severe is CVE-2022-4874?
CVE-2022-4874 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-4874?
Check the references section above for vendor advisories and patch information. Affected products include: Netcommwireless Nf20 Firmware, Netcommwireless Nf20, Netcommwireless Nf20Mesh Firmware, Netcommwireless Nf20Mesh, Netcommwireless Nl1902 Firmware.