CVE-2022-45291

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

P

WS Personal Weather Station Dashboard (PWS_Dashboard) LTS December 2020 (2012_lts) allows remote code execution by injecting PHP code into settings.php. Attacks can use the PWS_printfile.php, PWS_frame_text.php, PWS_listfile.php, PWS_winter.php, and PWS_easyweathersetup.php endpoints. A contributing factor is a hardcoded login password of support, which is not documented. (This is not the same as the documented setup password, which is 12345.) The issue was fixed in late 2022.

References

Link	Resource
https://cavefxa.com/posts/cve-2022-45291/	Exploit Technical Description Third Party Advisory
https://pwsdashboard.com/	Product
https://cavefxa.com/posts/cve-2022-45291/	Exploit Technical Description Third Party Advisory
https://pwsdashboard.com/	Product

Configurations

Configuration 1 (hide)

cpe:2.3:a:pwsdashboard:personal_weather_station_dashboard:-:*:*:*:*:*:*:*

History

21 Nov 2024, 07:29

Type	Values Removed	Values Added
References	~~() https://cavefxa.com/posts/cve-2022-45291/ - Exploit, Technical Description, Third Party Advisory~~	() https://cavefxa.com/posts/cve-2022-45291/ - Exploit, Technical Description, Third Party Advisory
References	~~() https://pwsdashboard.com/ - Product~~	() https://pwsdashboard.com/ - Product

Information

Published : 2023-04-25 19:15

Updated : 2025-02-04 18:15

NVD link : CVE-2022-45291

Mitre link : CVE-2022-45291

CVE.ORG link : CVE-2022-45291

JSON object : View

Products Affected

pwsdashboard

personal_weather_station_dashboard

CWE

CWE-798

Use of Hard-coded Credentials

{"id": "CVE-2022-45291", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "published": "2023-04-25T19:15:10.520", "references": [{"url": "https://cavefxa.com/posts/cve-2022-45291/", "tags": ["Exploit", "Technical Description", "Third Party Advisory"], "source": "[email protected]"}, {"url": "https://pwsdashboard.com/", "tags": ["Product"], "source": "[email protected]"}, {"url": "https://cavefxa.com/posts/cve-2022-45291/", "tags": ["Exploit", "Technical Description", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://pwsdashboard.com/", "tags": ["Product"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-798"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-798"}]}], "descriptions": [{"lang": "en", "value": "PWS Personal Weather Station Dashboard (PWS_Dashboard) LTS December 2020 (2012_lts) allows remote code execution by injecting PHP code into settings.php. Attacks can use the PWS_printfile.php, PWS_frame_text.php, PWS_listfile.php, PWS_winter.php, and PWS_easyweathersetup.php endpoints. A contributing factor is a hardcoded login password of support, which is not documented. (This is not the same as the documented setup password, which is 12345.) The issue was fixed in late 2022."}], "lastModified": "2025-02-04T18:15:32.290", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:pwsdashboard:personal_weather_station_dashboard:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3F21F28D-A86E-40D6-BAED-1A5D8AA88CEE"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}