CVE-2022-45724

Summary

Incorrect Access Control in Comfast router CF-WR6110N V2.3.1 allows a remote attacker on the same network to perform any HTTP request to an unauthenticated page to force the server to generate a SESSION_ID, and using this SESSION_ID an attacker can then perform authenticated requests.

Affected Software

Weaknesses

• n/a

ADP Enrichment

CVE Program Container

Additional References

• http://cf-wr6110n.com
• http://comfast.com
• http://sn0ox.com/research/2023/02/05/CVE-COMFAST-CF-WR610N.html

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: partial

Additional References

• http://sn0ox.com/research/2023/02/05/CVE-COMFAST-CF-WR610N.html

References

• http://sn0ox.com/research/2023/02/05/CVE-COMFAST-CF-WR610N.html

• ←Previous
• Next→