CVE-2022-28704
moderate-risk
Published 2022-06-13
Improper access control vulnerability in Rakuten Casa version AP_F_V1_4_1 or AP_F_V2_0_0 allows a remote attacker to log in with the root privilege and perform an arbitrary operation if the product is in its default settings in which is set to accept SSH connections from the WAN side, and is also connected to the Internet with the authentication information unchanged from the default settings.
Do I need to act?
~
8.6% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.2/10
High
NETWORK
/ LOW complexity
Affected Products (2)
Casa
Casa
Affected Vendors
References (4)
Third Party Advisory
https://jvn.jp/en/jp/JVN46892984/index.html
Third Party Advisory
https://jvn.jp/en/jp/JVN46892984/index.html
43
/ 100
moderate-risk
Severity
26/34 · High
Exploitability
10/34 · Low
Exposure
7/34 · Low