CVE Feed

    Dashboard / CVE / CVE-2022-3203

    CVE-2022-3203

    On ORing net IAP-420(+) with FW version 2.0m a telnet server is enabled by default and cannot permanently be disabled. You can connect to the device via LAN or WiFi with hardcoded credentials and get an administrative shell. These credentials are reset to defaults with every reboot.

    Published:Oct 21, 2022
    Last Modified:May 7, 2025
    EPS:Oct 21, 2022
    EPSS Score:0.00112
    CVSS Score:9.8

    Affected Products

    Vendor
    Oringnet
    Product
    Iap-420
    Vendor
    Oringnet
    Product
    Iap-420\+
    Vendor
    Oringnet
    Product
    Iap-420\+ Firmware
    Vendor
    Oringnet
    Product
    Iap-420 Firmware

    Exploits

    https://mads.uniud.it/2022/09/lord-of-the-orings/https://mads.uniud.it/2022/09/lord-of-the-orings/

    Common Weakness Enumeration

    CWE-912 Hidden Functionality

    Related CVEs

    CVE-2024-55548 (CVSS 6.9) — Improper check of password character lenght in ORing IAP-420 allows a forced deadlock. This issue affects IAP-…
    CVE-2024-55547 (CVSS 9.3) — SNMP objects in NET-SNMP used in ORing IAP-420 allows Command Injection. This issue affects IAP-420: through 2…
    CVE-2024-55546 (CVSS 7.1) — Missing input validation in the ORing IAP-420 web-interface allows stored Cross-Site Scripting (XSS).This issu…
    CVE-2024-55545 (CVSS 7.1) — Missing input validation in the ORing IAP-420 web-interface allows Cross-Site Scripting (XSS).This issue affec…
    CVE-2024-55544 (CVSS 8.7) — Missing input validation in the ORing IAP-420 web-interface allows authenticated Command Injections on OS leve…
    CVE-2024-5411 (CVSS 8.7) — Missing input validation and OS command integration of the input in the ORing IAP-420 web-interface allows aut…
    CVE-2024-5410 (CVSS 8.3) — Missing input validation in the ORing IAP-420 web-interface allows stored Cross-Site Scripting (XSS).This issu…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High