← Back

CVE-2022-47732

nvd nist
Published: Jan 20, 2023Modified: Jun 17, 2026

JSON object

Loading...
7.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Exploitability: 3.9 / Impact: 3.6
Source: NVD

Description

In Yeastar N412 and N824 Configuration Panel 42.x and 45.x, an unauthenticated attacker can create backup file and download it, revealing admin hash, allowing, once cracked, to login inside the Configuration Panel, otherwise, replacing the hash in the archive and restoring it on the device which will change admin password granting access to the device.

Affected (2)

Yeastar
2 products
N824 Firmware
N412 Firmware
Configuration A
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
N824 Firmware
All versions
Running on/withPlatform Versions
Yeastar
N824
All versions
Configuration B
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
N412 Firmware
All versions
Running on/withPlatform Versions
Yeastar
N412
All versions

Related CWEs

CWE-916
Use of Password Hash With Insufficient Computational Effort
The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.

References (4)

Source: cve@mitre.org
ExploitTechnical DescriptionThird Party Advisory
Source: cve@mitre.org
ProductVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitTechnical DescriptionThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ProductVendor Advisory

Timeline

No history available yet.