CVE-2022-40895

CVSS V2 None CVSS V3 Critical 9.1

Description

In certain Nedi products, a vulnerability in the web UI of NeDi login & Community login could allow an unauthenticated, remote attacker to affect the integrity of a device via a User Enumeration vulnerability. The vulnerability is due to insecure design, where a difference in forgot password utility could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users. This affects NeDi 1.0.7 for OS X 1.0.7 <= and NeDi for Suse 1.0.7 <= and NeDi for FreeBSD 1.0.7 <=.

Overview

CVE ID
CVE-2022-40895

Assigner
cve@mitre.org

Vulnerability Status
Analyzed

Published Version
2022-10-06T18:16:54

Last Modified Date
2022-10-07T20:11:10

Weakness Enumerations

CWE	URL
CWE-203	http://cwe.mitre.org/data/definitions/203.html

CPE Configuration (Product)

CPE	Vulnerable	Operator	Version End
cpe:2.3:a:nedi:nedi::::::freebsd::*	1	OR	1.0.7
cpe:2.3:a:nedi:nedi::::::suse::*	1	OR	1.0.7
cpe:2.3:a:nedi:nedi:1.0.7:::::mac_os_x::	1	OR

CVSS Version 3

Version
3.1

Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector
NETWORK

Attack Compatibility
LOW

Privileges Required
NONE

User Interaction
NONE

Scope
UNCHANGED

Confidentiality Impact
HIGH

Availability Impact
NONE

Base Score
9.1

Base Severity
CRITICAL

Exploitability Score
3.9

Impact Score
5.2

References

Reference URL	Reference Tags
http://forum.nedi.ch/index.php
https://www.nedi.ch/
https://gist.github.com/UditChavda/2f2effa477a429b485ae7e2dc3bbd04f

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2022-40895
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40895

History

Created	Old Value	New Value	Data Type	Notes
2022-10-06 19:00:57				Added to TrackCVE
2022-12-07 05:36:19	2022-10-06T18:16Z	2022-10-06T18:16:54	CVE Published Date	updated
2022-12-07 05:36:19		2022-10-07T20:11:10	CVE Modified Date	updated
2022-12-07 05:36:19		Analyzed	Vulnerability Status	updated