CVE-2022-36158

high

Description

Contec FXA3200 version 1.13.00 and under suffers from Insecure Permissions in the Wireless LAN Manager interface which allows malicious actors to execute Linux commands with root privilege via a hidden web page (/usr/www/ja/mnt_cmd.cgi).

References

https://www.contec.com/products-services/computer-networking/flexlan-fx/fx-accesspoint/fxa3200/feature/#section

https://samy.link/blog/contec-flexlan-fxa2000-and-fxa3000-series-vulnerability-repo

https://jvn.jp/en/vu/JVNVU98305100/

https://gist.github.com/Nwqda/aac33d1936d2b514a3268f145345abb4

Details

Source: Mitre, NVD

Published: 2022-09-26

Updated: 2026-06-17

Risk Information

CVSS v2

Base Score: 7.7

Vector: CVSS2#AV:A/AC:L/Au:S/C:C/I:C/A:C

Severity: High

CVSS v3

Base Score: 8

Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H