CVE-2022-43470

CVSS V2 None CVSS V3 None

Description

Cross-site request forgery (CSRF) vulnerability in +F FS040U software versions v2.3.4 and earlier, +F FS020W software versions v4.0.0 and earlier, +F FS030W software versions v3.3.5 and earlier, and +F FS040W software versions v1.4.1 and earlier allows an adjacent attacker to hijack the authentication of an administrator and user's unintended operations such as to reboot the product and/or reset the configuration to the initial set-up may be performed.

Overview

CVE ID
CVE-2022-43470

Assigner
vultures@jpcert.or.jp

Vulnerability Status
Analyzed

Published Version
2022-12-05T04:15:10

Last Modified Date
2022-12-06T16:39:26

Weakness Enumerations

CWE	URL
CWE-352	http://cwe.mitre.org/data/definitions/352.html

CPE Configuration (Product)

CPE	Vulnerable	Operator	Version End
		AND
cpe:2.3:o:fsi:fs040u_firmware::::::::	1	OR	2.3.4
cpe:2.3:h:fsi:fs040u:-:::::::*	0	OR
		AND
cpe:2.3:o:fsi:fs020w_firmware::::::::	1	OR	4.0.0
cpe:2.3:h:fsi:fs020w:-:::::::*	0	OR
		AND
cpe:2.3:o:fsi:fs030w_firmware::::::::	1	OR	3.3.5
cpe:2.3:h:fsi:fs030w:-:::::::*	0	OR
		AND
cpe:2.3:o:fsi:fs040w_firmware::::::::	1	OR	1.4.1
cpe:2.3:h:fsi:fs040w:-:::::::*	0	OR

References

Reference URL	Reference Tags
https://jvn.jp/en/jp/JVN74285622/index.html	Third Party Advisory
https://www.fsi.co.jp/mobile/plusF/news/22102801.html	Vendor Advisory
https://www.fsi.co.jp/mobile/plusF/news/22102802.html	Vendor Advisory
https://www.fsi.co.jp/mobile/plusF/news/22102803.html	Vendor Advisory
https://www.fsi.co.jp/mobile/plusF/news/22102804.html	Vendor Advisory

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2022-43470
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-43470

History

Created	Old Value	New Value	Data Type	Notes
2022-12-07 18:06:25				Added to TrackCVE
2022-12-18 04:34:19	2022-12-05T04:15:10.240	2022-12-05T04:15:10	CVE Published Date	updated
2022-12-18 04:34:19		2022-12-06T16:39:26	CVE Modified Date	updated