What is the CVSS score of CVE-2022-28940?

CVE-2022-28940 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 1.1%.

Is there a public PoC exploit available for CVE-2022-28940?

Yes, a public proof-of-concept exploit is available for CVE-2022-28940. Prioritise patching immediately. EPSS: 1.1%.

Magic R100 Firmware CVE-2022-28940

Q: Which versions of Magic R100 Firmware are affected by CVE-2022-28940?

In H3C MagicR100 <=V100R005, the / Ajax / ajaxget interface can be accessed without authorization.

HIGH

2022-05-04 cve@mitre.org

Information Disclosure Magic R100 Firmware

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVE Published

May 04, 2022 - 16:15 nvd

HIGH 7.5

DescriptionNVD

In H3C MagicR100 <=V100R005, the / Ajax / ajaxget interface can be accessed without authorization. It sends a large amount of data through ajaxmsg to carry out DOS attack.

AnalysisAI

In H3C MagicR100 <=V100R005, the / Ajax / ajaxget interface can be accessed without authorization. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

In H3C MagicR100 <=V100R005, the / Ajax / ajaxget interface can be accessed without authorization. It sends a large amount of data through ajaxmsg to carry out DOS attack. Affected products include: H3C Magic R100 Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Magic R100 Firmware

View all

CVE-2022-34598 CRITICAL Act Now POC

9.8 Jul 06

The udpserver in H3C Magic R100 V200R004 and V100R005 has the 9034 port opened, allowing attackers to execute arbitrary

CVE-2022-30926 CRITICAL Act Now POC

9.8 Jun 08

H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the EditMacList parameter at /g

CVE-2022-30925 CRITICAL Act Now POC

9.8 Jun 08

H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the AddMacList parameter at /go

CVE-2022-30924 CRITICAL Act Now POC

9.8 Jun 08

H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the SetAPWifiorLedInfoById para

CVE-2022-30923 CRITICAL Act Now POC

9.8 Jun 08

H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the Asp_SetTimingtimeWifiAndLed

CVE-2022-30922 CRITICAL Act Now POC

9.8 Jun 08

H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the EditWlanMacList parameter a

CVE-2022-30921 CRITICAL Act Now POC

9.8 Jun 08

H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the SetMobileAPInfoById paramet

CVE-2022-30920 CRITICAL Act Now POC

9.8 Jun 08

H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the Edit_BasicSSID parameter at

CVE-2022-30919 CRITICAL Act Now POC

9.8 Jun 08

H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the Edit_BasicSSID_5G parameter

CVE-2022-30918 CRITICAL Act Now POC

9.8 Jun 08

H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the Asp_SetTelnet parameter at

CVE-2022-30917 CRITICAL Act Now POC

9.8 Jun 08

H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the AddWlanMacList parameter at

CVE-2022-30916 CRITICAL Act Now POC

9.8 Jun 08

H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the Asp_SetTelnetDebug paramete

Same technique Information Disclosure

View all

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

CVE-2023-7028 CRITICAL POC

10.0

CVE-2017-0213 HIGH POC

7.3

CVE-2022-28940 vulnerability details – vuln.today

Back

Magic R100 Firmware CVE-2022-28940

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

RemediationAI

More in Magic R100 Firmware

Same technique Information Disclosure

Share

External POC / Exploit Code