CVE-2022-3203

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

On ORing net IAP-420(+) with FW version 2.0m a telnet server is enabled by default and cannot permanently be disabled. You can connect to the device via LAN or WiFi with hardcoded credentials and get an administrative shell. These credentials are reset to defaults with every reboot.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-912

Affected software

VendorProductVersions
ORingIAP-420(+)FW 2.0m

References

Timeline

Published
Oct 21, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-320307.5Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow via the list parameter in the function formSetQosBand.CVE-2022-320317.5Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow via the list parameter in the function fromSetRouteStatic.CVE-2022-320329.8Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow via the deviceList parameter in the function formAddMacfilterRule.CVE-2022-320337.5Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow via the function formSetVirtualSer.CVE-2022-320347.5Tenda M3 V1.0.0.12 was discovered to contain a stack overflow via the items parameter in the function formdelMasteraclist.CVE-2022-320357.5Tenda M3 V1.0.0.12 was discovered to contain a stack overflow via the function formMasterMng.CVE-2022-320367.5Tenda M3 V1.0.0.12 was discovered to contain multiple stack overflow vulnerabilities via the ssidList, storeName, and trademark parameters iCVE-2022-320377.5Tenda M3 V1.0.0.12 was discovered to contain a stack overflow via the function formSetAPCfg.CVE-2022-320397.5Tenda M3 V1.0.0.12 was discovered to contain a stack overflow via the listN parameter in the function fromDhcpListClient.CVE-2022-32047.5A vulnerability named 'Non-Responsive Delegation Attack' (NRDelegation Attack) has been discovered in various DNS resolving software. The NRCVE-2022-320407.5Tenda M3 V1.0.0.12 was discovered to contain a stack overflow via the function formSetCfm.CVE-2022-320417.5Tenda M3 V1.0.0.12 was discovered to contain a stack overflow via the function formGetPassengerAnalyseData.
CVE-2022-3203: Critical severity, CVSS 9.8 | Vulnix