CVE-2022-36158

HighCVSS 8.0/10Last modified Jun 17, 2026

Description

Contec FXA3200 version 1.13.00 and under suffers from Insecure Permissions in the Wireless LAN Manager interface which allows malicious actors to execute Linux commands with root privilege via a hidden web page (/usr/www/ja/mnt_cmd.cgi).

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-425

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://gist.github.com/Nwqda/aac33d1936d2b514a3268f145345abb4Broken Link, Third Party Advisory
https://jvn.jp/en/vu/JVNVU98305100/Patch, Third Party Advisory
https://samy.link/blog/contec-flexlan-fxa2000-and-fxa3000-series-vulnerability-repoExploit, Mitigation, Third Party Advisory
https://www.contec.com/products-services/computer-networking/flexlan-fx/fx-accesspoint/fxa3200/feature/#sectionProduct
https://gist.github.com/Nwqda/aac33d1936d2b514a3268f145345abb4Broken Link, Third Party Advisory
https://jvn.jp/en/vu/JVNVU98305100/Patch, Third Party Advisory
https://samy.link/blog/contec-flexlan-fxa2000-and-fxa3000-series-vulnerability-repoExploit, Mitigation, Third Party Advisory
https://www.contec.com/products-services/computer-networking/flexlan-fx/fx-accesspoint/fxa3200/feature/#sectionProduct

Timeline

Published: Sep 26, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-361598.8Contec FXA3200 version 1.13 and under were discovered to contain a hard coded hash password for root stored in the component /etc/shadow. As CVE-2022-36167.5Attackers can create long chains of CAs that would lead to OctoRPKI exceeding its max iterations parameter. In consequence it would cause th CVE-2022-361619.8Orange Station 1.0 was discovered to contain a SQL injection vulnerability via the username parameter.CVE-2022-361682.7A directory traversal vulnerability was discovered in Wuzhicms 4.1.0. via /coreframe/app/attachment/admin/index.php:CVE-2022-361708.8MapGIS 10.5 Pro IGServer has hardcoded credentials in the front-end and can lead to escalation of privileges and arbitrary file deletion.CVE-2022-361718.1MapGIS IGServer 10.5.6.11 is vulnerable to Arbitrary file deletion.CVE-2022-361738.1FreshService macOS Agent < 4.4.0 and FreshServce Linux Agent < 3.4.0 are vulnerable to TLS Man-in-The-Middle via the FreshAgent client and s CVE-2022-361748.1FreshService Windows Agent < 2.11.0 and FreshService macOS Agent < 4.2.0 and FreshService Linux Agent < 3.3.0. are vulnerable to Broken inte CVE-2022-361799.8Fusiondirectory 1.3 suffers from Improper Session Handling.CVE-2022-36184.8The Spacer WordPress plugin before 3.0.7 does not sanitize and escapes some of its settings, which could allow high-privilege users such as CVE-2022-361809.6Fusiondirectory 1.3 is vulnerable to Cross Site Scripting (XSS) via /fusiondirectory/index.php?message=[injection], /fusiondirectory/index.p CVE-2022-361826.1Hashicorp Boundary v0.8.0 is vulnerable to Clickjacking which allow for the interception of login credentials, re-direction of users to mali