Vulnerability identifier: #VU60304

Vulnerability risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-21800

CWE-ID: CWE-327

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
MMP
Hardware solutions / Firmware
PTP C-series
Hardware solutions / Firmware
PTMP C-series
Hardware solutions / Firmware
PTMP A5x
Hardware solutions / Firmware

Vendor:

Description

The vulnerability allows a remote user to compromise the target system.

The vulnerability exists due to the affected product uses the MD5 algorithm to hash the passwords before storing them but does not salt the hash. A remote authenticated attacker can crack the hashed passwords.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

---

External links
http://ics-cert.us-cert.gov/advisories/icsa-22-034-02

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.