CVE-2022-22144

Summary

A hard-coded password vulnerability exists in the libcommonprod.so prod_change_root_passwd functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. During system startup this functionality is always called, leading to a known root password. An attacker does not have to do anything to trigger this vulnerability.

Affected Software

VendorProductVersion RangeStatus
TCLLinkHub Mesh WifiMS1G_00_01.00_14affected

Weaknesses

  • CWE-259: CWE-259: Use of Hard-coded Password

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: no
    • Technical Impact: total

References