CVE-2022-23765

HIGH

Published Aug 17, 20223y ago · Modified Jun 17, 20262w ago

8.8 CVSS 3.1

High

Published Aug 17, 2022 3y ago

Last Modified Jun 17, 2026 2w ago

Description

This vulnerability occured by sending a malicious POST request to a specific page while logged in random user from some family of IPTIME NAS. Remote attackers can steal root privileges by changing the password of the root through a POST request.

CVSS Details

Base Score

8.8

Exploitability

2.8

Impact

5.9

Vector string

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction Required

Scope Unchanged

Confidentiality High

Integrity High

Availability High

Threat Intelligence

No active exploitation signals — not in CISA KEV and no EPSS score yet.

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-352 Cross-Site Request Forgery (CSRF) Authentication

Affected Products 6

Vendor	Product	Version	Range
iptime	nas1dual_firmware	*	<1.4.86
iptime	nas1dual	*	any
iptime	nas2dual_firmware	*	<1.4.86
iptime	nas2dual	*	any
iptime	nas4dual_firmware	*	<1.4.86
iptime	nas4dual	*	any

References 1

krcert.or.kr https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66877

Third Party Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.