CVE-2022-40895

 

Published at: - 06-10-2022 08:16

Last modified: - 07-10-2022 10:11

Total changes: - 2

Description

In certain Nedi products, a vulnerability in the web UI of NeDi login & Community login could allow an unauthenticated, remote attacker to affect the integrity of a device via a User Enumeration vulnerability. The vulnerability is due to insecure design, where a difference in forgot password utility could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users. This affects NeDi 1.0.7 for OS X 1.0.7 <= and NeDi for Suse 1.0.7 <= and NeDi for FreeBSD 1.0.7 <=.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

 

Verification logic

 

Reference

• http://forum.nedi.ch/index.php
• https://www.nedi.ch/
• https://gist.github.com/UditChavda/2f2effa477a429b485ae7e2dc3bbd04f

 

Keywords

NVD

 

CVE-2022-40895

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures