CVE-2022-40494

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

NPS before v0.26.10 was discovered to contain an authentication bypass vulnerability via constantly generating and sending the Auth key and Timestamp parameters.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://blog.carrot2.cn/2022/08/cve-2022-40494.htmlExploit, Third Party Advisory
https://github.com/1security/Vulnerability/blob/main/web/nps/1.mdBroken Link
https://blog.carrot2.cn/2022/08/cve-2022-40494.htmlExploit, Third Party Advisory
https://github.com/1security/Vulnerability/blob/main/web/nps/1.mdBroken Link

Timeline

Published: Oct 6, 2022
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2022

CVE-2022-404978.8Wazuh v3.6.1 - v3.13.5, v4.0.0 - v4.2.7, and v4.3.0 - v4.3.7 were discovered to contain an authenticated remote code execution (RCE) vulnera CVE-2022-40509.8The JoomSport WordPress plugin before 5.2.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to CVE-2022-405027.5Transient DOS due to improper input validation in WLAN Host.CVE-2022-405037.5Information disclosure due to buffer over-read in Bluetooth Host while A2DP streaming.CVE-2022-405047.5Transient DOS due to reachable assertion in Modem when UE received Downlink Data Indication message from the network.CVE-2022-405057.5Information disclosure due to buffer over-read in Modem while parsing DNS hostname.CVE-2022-405077.8Memory corruption due to double free in Core while mapping HLOS address to the list.CVE-2022-405087.5Transient DOS due to reachable assertion in Modem while processing config related to cross carrier scheduling, which is not supported.CVE-2022-40519.8A vulnerability has been found in Hostel Searching Project and classified as critical. This vulnerability affects unknown code of the file v CVE-2022-405109.8Memory corruption due to buffer copy without checking size of input in Audio while voice call with EVS vocoder.CVE-2022-405127.5Transient DOS in WLAN Firmware due to buffer over-read while processing probe response or beacon.CVE-2022-405137.5Transient DOS due to uncontrolled resource consumption in WLAN firmware when peer is freed in non qos state.