P5E Gnss Firmware
CVE-2022-30624
HIGH
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Lifecycle Timeline
1DescriptionNVD
Browsing the admin.html page allows the user to reset the admin password. Also appears in the JS code for the password.
AnalysisAI
Browsing the admin.html page allows the user to reset the admin password. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as Improper Authentication (CWE-287), which allows attackers to bypass authentication mechanisms to gain unauthorized access. Browsing the admin.html page allows the user to reset the admin password. Also appears in the JS code for the password. Affected products include: Chcnav P5E Gnss Firmware.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Implement multi-factor authentication, enforce strong password policies, use proven authentication frameworks.
More in P5E Gnss Firmware
View allThe server checks the user's cookie in a non-standard way, and a value is entered in the cookie value name of the status
This vulnerability affects all of the company's products that also include the FW versions: update_i90_cv2.021_b20210104
Browsing the path: http://ip/wifi_ap_pata_get.cmd, will show in the name of the existing access point on the component,
Disclosure of information - the system allows you to view usernames and passwords without permissions, thus it will be p
Directory listing is a web server function that displays the directory contents when there is no index file in a specifi
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today