CVE-2022-36158

State: Published
Severity: 8.8 High
Published: Sep 26, 2022
Updated: May 21, 2025
Reserved: Jul 18, 2022

Description

Contec FXA3200 version 1.13.00 and under suffers from Insecure Permissions in the Wireless LAN Manager interface which allows malicious actors to execute Linux commands with root privilege via a hidden web page (/usr/www/ja/mnt_cmd.cgi).

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-425 Direct Request ('Forced Browsing')

Affected Products

Product	Versions
n/an/a	n/aAffected

References

https://www.contec.com/products-services/computer-networking/flexlan-fx/fx-accesspoint/fxa3200/feature/#section
https://gist.github.com/Nwqda/aac33d1936d2b514a3268f145345abb4
https://samy.link/blog/contec-flexlan-fxa2000-and-fxa3000-series-vulnerability-repo
https://jvn.jp/en/vu/JVNVU98305100/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.