Vulnerability-Lookup

CVE-2022-44620 (GCVE-0-2022-44620)

Vulnerability from cvelistv5 – Published: 2022-12-07 00:00 – Updated: 2025-04-23 13:55

Summary

Improper authentication vulnerability in UDR-JA1604/UDR-JA1608/UDR-JA1616 firmware versions 71x10.1.107112.43A and earlier allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter the device settings.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-04-23 13:54 UTC

CWE

Improper Authentication
CWE-287 - Improper Authentication

Assigner

jpcert jpcert root

References

2 references

URL	Tags
http://www.unimo.co.jp/table_notice/index.php?act…
https://jvn.jp/en/vu/JVNVU94514762/index.html

Impacted products

1 product

Vendor	Product	Version	CPE status
UNIMO Technology Co., Ltd	UDR-JA1604/UDR-JA1608/UDR-JA1616	Affected: firmware versions 71x10.1.107112.43A and earlier	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T13:54:04.078Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.unimo.co.jp/table_notice/index.php?act=1\u0026resid=1666831567-004418"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/vu/JVNVU94514762/index.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-44620",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-23T13:54:24.655653Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-287",
                "description": "CWE-287 Improper Authentication",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-23T13:55:14.349Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "UDR-JA1604/UDR-JA1608/UDR-JA1616",
          "vendor": "UNIMO Technology Co., Ltd",
          "versions": [
            {
              "status": "affected",
              "version": "firmware versions 71x10.1.107112.43A and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper authentication vulnerability in UDR-JA1604/UDR-JA1608/UDR-JA1616 firmware versions 71x10.1.107112.43A and earlier allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter the device settings."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Improper Authentication",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-12-07T00:00:00.000Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "http://www.unimo.co.jp/table_notice/index.php?act=1\u0026resid=1666831567-004418"
        },
        {
          "url": "https://jvn.jp/en/vu/JVNVU94514762/index.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2022-44620",
    "datePublished": "2022-12-07T00:00:00.000Z",
    "dateReserved": "2022-11-28T00:00:00.000Z",
    "dateUpdated": "2025-04-23T13:55:14.349Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-44620",
      "date": "2026-09-18",
      "epss": "0.0089",
      "percentile": "0.57785"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:unimo:udr-ja1604_firmware:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "99DA0D26-FD5D-4860-84A0-F86FEA903AA0",
                  "versionEndExcluding": "71x10.1.107114.43a",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:h:unimo:udr-ja1604:-:*:*:*:*:*:*:*",
                  "matchCriteriaId": "933D45D2-5783-43F7-A1B8-24991E500286",
                  "vulnerable": false
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:unimo:udr-ja1608_firmware:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "3E2CC7AC-CFA5-4AF1-8A4E-F40795AEA845",
                  "versionEndExcluding": "71x10.1.107114.43a",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:h:unimo:udr-ja1608:-:*:*:*:*:*:*:*",
                  "matchCriteriaId": "E7791FE4-B100-4521-BE13-B6A98672DA31",
                  "vulnerable": false
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:unimo:udr-ja1616_firmware:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "A3C485A8-CA43-45F0-BA28-222FE5AEF63C",
                  "versionEndExcluding": "71x10.1.107114.43a",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:h:unimo:udr-ja1616:-:*:*:*:*:*:*:*",
                  "matchCriteriaId": "EBB2D76C-2BE0-44CD-AD0A-5BCC8ABD0C04",
                  "vulnerable": false
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper authentication vulnerability in UDR-JA1604/UDR-JA1608/UDR-JA1616 firmware versions 71x10.1.107112.43A and earlier allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter the device settings."
        },
        {
          "lang": "es",
          "value": "Vulnerabilidad de autenticaci\u00f3n incorrecta en las versiones de firmware UDR-JA1604/UDR-JA1608/UDR-JA1616 71x10.1.107112.43A y anteriores permite a un atacante remoto autenticado ejecutar un comando arbitrario del sistema operativo en el dispositivo o alterar la configuraci\u00f3n del dispositivo."
        }
      ],
      "id": "CVE-2022-44620",
      "lastModified": "2024-11-21T07:28:12.637",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 2.8,
            "impactScore": 5.9,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2022-12-07T04:15:11.170",
      "references": [
        {
          "source": "vultures@jpcert.or.jp",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "http://www.unimo.co.jp/table_notice/index.php?act=1\u0026resid=1666831567-004418"
        },
        {
          "source": "vultures@jpcert.or.jp",
          "tags": [
            "Third Party Advisory"
          ],
          "url": "https://jvn.jp/en/vu/JVNVU94514762/index.html"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "http://www.unimo.co.jp/table_notice/index.php?act=1\u0026resid=1666831567-004418"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Third Party Advisory"
          ],
          "url": "https://jvn.jp/en/vu/JVNVU94514762/index.html"
        }
      ],
      "sourceIdentifier": "vultures@jpcert.or.jp",
      "vulnStatus": "Modified",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-287"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "UDR-JA1604/UDR-JA1608/UDR-JA1616",
                "vendor": "UNIMO Technology Co., Ltd",
                "versions": [
                  {
                    "status": "affected",
                    "version": "firmware versions 71x10.1.107112.43A and earlier"
                  }
                ]
              }
            ],
            "source": "vultures@jpcert.or.jp"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:unimo:udr-ja1604_firmware:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "99DA0D26-FD5D-4860-84A0-F86FEA903AA0",
                    "versionEndExcluding": "71x10.1.107114.43a",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:unimo:udr-ja1604:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "933D45D2-5783-43F7-A1B8-24991E500286",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:unimo:udr-ja1608_firmware:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "3E2CC7AC-CFA5-4AF1-8A4E-F40795AEA845",
                    "versionEndExcluding": "71x10.1.107114.43a",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:unimo:udr-ja1608:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E7791FE4-B100-4521-BE13-B6A98672DA31",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:unimo:udr-ja1616_firmware:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A3C485A8-CA43-45F0-BA28-222FE5AEF63C",
                    "versionEndExcluding": "71x10.1.107114.43a",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:unimo:udr-ja1616:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "EBB2D76C-2BE0-44CD-AD0A-5BCC8ABD0C04",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Improper authentication vulnerability in UDR-JA1604/UDR-JA1608/UDR-JA1616 firmware versions 71x10.1.107112.43A and earlier allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter the device settings."
          },
          {
            "lang": "es",
            "value": "Vulnerabilidad de autenticaci\u00f3n incorrecta en las versiones de firmware UDR-JA1604/UDR-JA1608/UDR-JA1616 71x10.1.107112.43A y anteriores permite a un atacante remoto autenticado ejecutar un comando arbitrario del sistema operativo en el dispositivo o alterar la configuraci\u00f3n del dispositivo."
          }
        ],
        "id": "CVE-2022-44620",
        "lastModified": "2026-06-17T05:08:36.950",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2022-44620",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-23T13:54:24.655653Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2022-12-07T04:15:11.170",
        "references": [
          {
            "source": "vultures@jpcert.or.jp",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "http://www.unimo.co.jp/table_notice/index.php?act=1\u0026resid=1666831567-004418"
          },
          {
            "source": "vultures@jpcert.or.jp",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://jvn.jp/en/vu/JVNVU94514762/index.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "http://www.unimo.co.jp/table_notice/index.php?act=1\u0026resid=1666831567-004418"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://jvn.jp/en/vu/JVNVU94514762/index.html"
          }
        ],
        "sourceIdentifier": "vultures@jpcert.or.jp",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-287"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-287"
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-05-29T02:48:10+00:00",
      "cve": "CVE-2022-44620",
      "id": "CVE-2022-44620",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "CVE-2022-44620",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-44620.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-03T13:54:04.078Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "http://www.unimo.co.jp/table_notice/index.php?act=1\u0026resid=1666831567-004418"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://jvn.jp/en/vu/JVNVU94514762/index.html"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "NETWORK",
                  "availabilityImpact": "HIGH",
                  "baseScore": 8.8,
                  "baseSeverity": "HIGH",
                  "confidentialityImpact": "HIGH",
                  "integrityImpact": "HIGH",
                  "privilegesRequired": "LOW",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2022-44620",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-04-23T13:54:24.655653Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-287",
                    "description": "CWE-287 Improper Authentication",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-04-23T13:55:00.502Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "UDR-JA1604/UDR-JA1608/UDR-JA1616",
              "vendor": "UNIMO Technology Co., Ltd",
              "versions": [
                {
                  "status": "affected",
                  "version": "firmware versions 71x10.1.107112.43A and earlier"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Improper authentication vulnerability in UDR-JA1604/UDR-JA1608/UDR-JA1616 firmware versions 71x10.1.107112.43A and earlier allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter the device settings."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "Improper Authentication",
                  "lang": "en",
                  "type": "text"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2022-12-07T00:00:00.000Z",
            "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
            "shortName": "jpcert"
          },
          "references": [
            {
              "url": "http://www.unimo.co.jp/table_notice/index.php?act=1\u0026resid=1666831567-004418"
            },
            {
              "url": "https://jvn.jp/en/vu/JVNVU94514762/index.html"
            }
          ]
        }
      },
      "cveMetadata": {
        "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "assignerShortName": "jpcert",
        "cveId": "CVE-2022-44620",
        "datePublished": "2022-12-07T00:00:00.000Z",
        "dateReserved": "2022-11-28T00:00:00.000Z",
        "dateUpdated": "2025-04-23T13:55:14.349Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2022-44620

Vulnerability from fkie_nvd - Published: 2022-12-07 04:15 - Updated: 2026-06-17 05:08

Severity

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

References

URL	Tags
vultures@jpcert.or.jp	http://www.unimo.co.jp/table_notice/index.php?act=1&resid=1666831567-004418	Vendor Advisory
vultures@jpcert.or.jp	https://jvn.jp/en/vu/JVNVU94514762/index.html	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	http://www.unimo.co.jp/table_notice/index.php?act=1&resid=1666831567-004418	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://jvn.jp/en/vu/JVNVU94514762/index.html	Third Party Advisory

Impacted products

Vendor	Product	Version
unimo	udr-ja1604_firmware	*
unimo	udr-ja1604	-
unimo	udr-ja1608_firmware	*
unimo	udr-ja1608	-
unimo	udr-ja1616_firmware	*
unimo	udr-ja1616	-

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "UDR-JA1604/UDR-JA1608/UDR-JA1616",
          "vendor": "UNIMO Technology Co., Ltd",
          "versions": [
            {
              "status": "affected",
              "version": "firmware versions 71x10.1.107112.43A and earlier"
            }
          ]
        }
      ],
      "source": "vultures@jpcert.or.jp"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:unimo:udr-ja1604_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "99DA0D26-FD5D-4860-84A0-F86FEA903AA0",
              "versionEndExcluding": "71x10.1.107114.43a",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:unimo:udr-ja1604:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "933D45D2-5783-43F7-A1B8-24991E500286",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:unimo:udr-ja1608_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "3E2CC7AC-CFA5-4AF1-8A4E-F40795AEA845",
              "versionEndExcluding": "71x10.1.107114.43a",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:unimo:udr-ja1608:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E7791FE4-B100-4521-BE13-B6A98672DA31",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:unimo:udr-ja1616_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A3C485A8-CA43-45F0-BA28-222FE5AEF63C",
              "versionEndExcluding": "71x10.1.107114.43a",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:unimo:udr-ja1616:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "EBB2D76C-2BE0-44CD-AD0A-5BCC8ABD0C04",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper authentication vulnerability in UDR-JA1604/UDR-JA1608/UDR-JA1616 firmware versions 71x10.1.107112.43A and earlier allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter the device settings."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de autenticaci\u00f3n incorrecta en las versiones de firmware UDR-JA1604/UDR-JA1608/UDR-JA1616 71x10.1.107112.43A y anteriores permite a un atacante remoto autenticado ejecutar un comando arbitrario del sistema operativo en el dispositivo o alterar la configuraci\u00f3n del dispositivo."
    }
  ],
  "id": "CVE-2022-44620",
  "lastModified": "2026-06-17T05:08:36.950",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-44620",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-04-23T13:54:24.655653Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2022-12-07T04:15:11.170",
  "references": [
    {
      "source": "vultures@jpcert.or.jp",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.unimo.co.jp/table_notice/index.php?act=1\u0026resid=1666831567-004418"
    },
    {
      "source": "vultures@jpcert.or.jp",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://jvn.jp/en/vu/JVNVU94514762/index.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.unimo.co.jp/table_notice/index.php?act=1\u0026resid=1666831567-004418"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://jvn.jp/en/vu/JVNVU94514762/index.html"
    }
  ],
  "sourceIdentifier": "vultures@jpcert.or.jp",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

GHSA-XMJ9-XQ4J-XH3H

Vulnerability from github – Published: 2022-12-07 06:30 – Updated: 2022-12-10 00:30

Details

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2022-44620"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-12-07T04:15:00Z",
    "severity": "HIGH"
  },
  "details": "Improper authentication vulnerability in UDR-JA1604/UDR-JA1608/UDR-JA1616 firmware versions 71x10.1.107112.43A and earlier allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter the device settings.",
  "id": "GHSA-xmj9-xq4j-xh3h",
  "modified": "2022-12-10T00:30:17Z",
  "published": "2022-12-07T06:30:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-44620"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/en/vu/JVNVU94514762/index.html"
    },
    {
      "type": "WEB",
      "url": "http://www.unimo.co.jp/table_notice/index.php?act=1\u0026resid=1666831567-004418"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GSD-2022-44620

Vulnerability from gsd - Updated: 2023-12-13 01:19

Details

Aliases

CVE-2022-44620

Aliases

CVE-2022-44620

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2022-44620",
    "description": "Improper authentication vulnerability in UDR-JA1604/UDR-JA1608/UDR-JA1616 firmware versions 71x10.1.107112.43A and earlier allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter the device settings.",
    "id": "GSD-2022-44620"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2022-44620"
      ],
      "details": "Improper authentication vulnerability in UDR-JA1604/UDR-JA1608/UDR-JA1616 firmware versions 71x10.1.107112.43A and earlier allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter the device settings.",
      "id": "GSD-2022-44620",
      "modified": "2023-12-13T01:19:25.513575Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "vultures@jpcert.or.jp",
        "ID": "CVE-2022-44620",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "UDR-JA1604/UDR-JA1608/UDR-JA1616",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "firmware versions 71x10.1.107112.43A and earlier"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "UNIMO Technology Co., Ltd"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Improper authentication vulnerability in UDR-JA1604/UDR-JA1608/UDR-JA1616 firmware versions 71x10.1.107112.43A and earlier allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter the device settings."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "Improper Authentication"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "http://www.unimo.co.jp/table_notice/index.php?act=1\u0026resid=1666831567-004418",
            "refsource": "MISC",
            "url": "http://www.unimo.co.jp/table_notice/index.php?act=1\u0026resid=1666831567-004418"
          },
          {
            "name": "https://jvn.jp/en/vu/JVNVU94514762/index.html",
            "refsource": "MISC",
            "url": "https://jvn.jp/en/vu/JVNVU94514762/index.html"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:unimo:udr-ja1604_firmware:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "71x10.1.107114.43a",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:unimo:udr-ja1604:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:unimo:udr-ja1608_firmware:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "71x10.1.107114.43a",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:unimo:udr-ja1608:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:unimo:udr-ja1616_firmware:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "71x10.1.107114.43a",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:unimo:udr-ja1616:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2022-44620"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Improper authentication vulnerability in UDR-JA1604/UDR-JA1608/UDR-JA1616 firmware versions 71x10.1.107112.43A and earlier allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter the device settings."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-287"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.unimo.co.jp/table_notice/index.php?act=1\u0026resid=1666831567-004418",
              "refsource": "MISC",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "http://www.unimo.co.jp/table_notice/index.php?act=1\u0026resid=1666831567-004418"
            },
            {
              "name": "https://jvn.jp/en/vu/JVNVU94514762/index.html",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://jvn.jp/en/vu/JVNVU94514762/index.html"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2022-12-09T21:32Z",
      "publishedDate": "2022-12-07T04:15Z"
    }
  }
}

JVNDB-2022-002768

Vulnerability from jvndb - Published: 2022-12-02 05:57 - Updated:2024-06-03 07:55

Severity

8.8 (High) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

Multiple vulnerabilities in UNIMO Technology digital video recorders

Details

Multiple digital video recorders provided by UNIMO Technology Co., Ltd contain multiple vulnerabilities listed below. * Improper Authentication (CWE-287) - CVE-2022-44620 * OS Command Injection (CWE-78) - CVE-2022-44606 * Hidden Functionality (CWE-912) - CVE-2022-43464 The reporter states that attacks exploiting these vulnerabilities have been observed. Yoshiki Mori, Ushimaru Hayato, Hiromu Kubiura and Masaki Kubo of National Institute of Information and Communications Technology Cybersecurity Research Institute reported these vulnerabilities to the developer and coordinated. After coordination was completed, this case was reported to JPCERT/CC and JPCERT/CC coordinated with the developer for the publication.

References

Type

URL

	JVN	https://jvn.jp/en/vu/JVNVU94514762/index.html
	CVE	https://www.cve.org/CVERecord?id=CVE-2022-44620
	CVE	https://www.cve.org/CVERecord?id=CVE-2022-44606
	CVE	https://www.cve.org/CVERecord?id=CVE-2022-43464
	NVD	https://nvd.nist.gov/vuln/detail/CVE-2022-43464
	NVD	https://nvd.nist.gov/vuln/detail/CVE-2022-44606
	NVD	https://nvd.nist.gov/vuln/detail/CVE-2022-44620
	Improper Authentication(CWE-287)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html
	OS Command Injection(CWE-78)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html
	Hidden Functionality(CWE-912)	https://cwe.mitre.org/data/definitions/912.html

Impacted products

Vendor

Product

	UNIMO Technology Co., Ltd	UDR-JA1604 firmware
	UNIMO Technology Co., Ltd	UDR-JA1608 firmware
	UNIMO Technology Co., Ltd	UDR-JA1616 firmware

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2022/JVNDB-2022-002768.html",
  "dc:date": "2024-06-03T16:55+09:00",
  "dcterms:issued": "2022-12-02T14:57+09:00",
  "dcterms:modified": "2024-06-03T16:55+09:00",
  "description": "Multiple digital video recorders provided by UNIMO Technology Co., Ltd contain multiple vulnerabilities listed below.\r\n\r\n  * Improper Authentication (CWE-287) - CVE-2022-44620\r\n  * OS Command Injection (CWE-78) - CVE-2022-44606\r\n  * Hidden Functionality (CWE-912) - CVE-2022-43464\r\n\r\nThe reporter states that attacks exploiting these vulnerabilities have been observed.\r\n\r\nYoshiki Mori, Ushimaru Hayato, Hiromu Kubiura and Masaki Kubo of National Institute of Information and Communications Technology Cybersecurity Research Institute reported these vulnerabilities to the developer and coordinated. After coordination was completed, this case was reported to JPCERT/CC and JPCERT/CC coordinated with the developer for the publication.",
  "link": "https://jvndb.jvn.jp/en/contents/2022/JVNDB-2022-002768.html",
  "sec:cpe": [
    {
      "#text": "cpe:/o:unimo:udr-ja1604_firmware",
      "@product": "UDR-JA1604 firmware",
      "@vendor": "UNIMO Technology Co., Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:unimo:udr-ja1608_firmware",
      "@product": "UDR-JA1608 firmware",
      "@vendor": "UNIMO Technology Co., Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:unimo:udr-ja1616_firmware",
      "@product": "UDR-JA1616 firmware",
      "@vendor": "UNIMO Technology Co., Ltd",
      "@version": "2.2"
    }
  ],
  "sec:cvss": {
    "@score": "8.8",
    "@severity": "High",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2022-002768",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/vu/JVNVU94514762/index.html",
      "@id": "JVNVU#94514762",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2022-44620",
      "@id": "CVE-2022-44620",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2022-44606",
      "@id": "CVE-2022-44606",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2022-43464",
      "@id": "CVE-2022-43464",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2022-43464",
      "@id": "CVE-2022-43464",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2022-44606",
      "@id": "CVE-2022-44606",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2022-44620",
      "@id": "CVE-2022-44620",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-287",
      "@title": "Improper Authentication(CWE-287)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-78",
      "@title": "OS Command Injection(CWE-78)"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/912.html",
      "@id": "CWE-912",
      "@title": "Hidden Functionality(CWE-912)"
    }
  ],
  "title": "Multiple vulnerabilities in UNIMO Technology digital video recorders"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2022-44620 (GCVE-0-2022-44620)

FKIE_CVE-2022-44620

GHSA-XMJ9-XQ4J-XH3H

GSD-2022-44620

JVNDB-2022-002768

Tags

Sightings

Nomenclature

Related by attack behaviour