CVE-2023-7211

A vulnerability was found in Uniway Router 2.0. It has been declared as critical. This vulnerability affects unknown code of the component Administrative Web Interface. The manipulation leads to reliance on ip address for authentication. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. VDB-249766 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS v3.0 8.1 HIGH

8.1^/10

CVSS v3.0 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://vuldb.com/?id.249766	Permissions Required Third Party Advisory VDB Entry
https://vuldb.com/?ctiid.249766	Permissions Required VDB Entry
https://drive.google.com/file/d/11thSuALGcn0C_9tbmYu8_QzTXtBnCoNS/view?usp=sharing	Exploit

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:uniwayinfo:uw-302vp_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:uniwayinfo:uw-302vp:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:uniwayinfo:uw-301vpw_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:uniwayinfo:uw-301vpw:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND

cpe:2.3:o:uniwayinfo:uw-311vpw_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:uniwayinfo:uw-311vpw:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND

cpe:2.3:o:uniwayinfo:uw-101x_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:uniwayinfo:uw-101x:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND

cpe:2.3:o:uniwayinfo:uw-323dac_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:uniwayinfo:uw-323dac:-:*:*:*:*:*:*:*

Information

Published : 2024-01-07 10:15

Updated : 2024-01-11 16:38

NVD link : CVE-2023-7211

Mitre link : CVE-2023-7211

JSON object : View

Products Affected

uniwayinfo

uw-323dac
uw-301vpw_firmware
uw-302vp_firmware
uw-101x
uw-323dac_firmware
uw-311vpw
uw-101x_firmware
uw-302vp
uw-311vpw_firmware
uw-301vpw

CWE

CWE-287

Improper Authentication

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://vuldb.com/?id.249766", "name": "https://vuldb.com/?id.249766", "tags": ["Permissions Required", "Third Party Advisory", "VDB Entry"], "refsource": ""}, {"url": "https://vuldb.com/?ctiid.249766", "name": "https://vuldb.com/?ctiid.249766", "tags": ["Permissions Required", "VDB Entry"], "refsource": ""}, {"url": "https://drive.google.com/file/d/11thSuALGcn0C_9tbmYu8_QzTXtBnCoNS/view?usp=sharing", "name": "https://drive.google.com/file/d/11thSuALGcn0C_9tbmYu8_QzTXtBnCoNS/view?usp=sharing", "tags": ["Exploit"], "refsource": ""}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "A vulnerability was found in Uniway Router 2.0. It has been declared as critical. This vulnerability affects unknown code of the component Administrative Web Interface. The manipulation leads to reliance on ip address for authentication. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. VDB-249766 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-287"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2023-7211", "ASSIGNER": "cna@vuldb.com"}}, "impact": {"baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}}, "publishedDate": "2024-01-07T10:15Z", "configurations": {"nodes": [{"children": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:uniwayinfo:uw-302vp_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "2.0"}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:h:uniwayinfo:uw-302vp:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}]}], "operator": "AND", "cpe_match": []}, {"children": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:uniwayinfo:uw-301vpw_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "2.0"}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:h:uniwayinfo:uw-301vpw:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}]}], "operator": "AND", "cpe_match": []}, {"children": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:uniwayinfo:uw-311vpw_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "2.0"}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:h:uniwayinfo:uw-311vpw:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}]}], "operator": "AND", "cpe_match": []}, {"children": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:uniwayinfo:uw-101x_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "2.0"}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:h:uniwayinfo:uw-101x:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}]}], "operator": "AND", "cpe_match": []}, {"children": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:uniwayinfo:uw-323dac_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "2.0"}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:h:uniwayinfo:uw-323dac:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}]}], "operator": "AND", "cpe_match": []}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2024-01-11T16:38Z"}