CVE-2022-46637

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Prolink router PRS1841 was discovered to contain hardcoded credentials for its Telnet and FTP services.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-798

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://0xsp.com/security%20research%20%20development%20srd/backdoor-discovered-in-pldt-home-fiber-routers/Exploit, Third Party Advisory
https://packetstormsecurity.com/files/170342/ProLink-PRS1841-Backdoor-Account.htmlThird Party Advisory, VDB Entry
https://prolink2u.com/product/prs1841/Product, Vendor Advisory
https://0xsp.com/security%20research%20%20development%20srd/backdoor-discovered-in-pldt-home-fiber-routers/Exploit, Third Party Advisory
https://packetstormsecurity.com/files/170342/ProLink-PRS1841-Backdoor-Account.htmlThird Party Advisory, VDB Entry
https://prolink2u.com/product/prs1841/Product, Vendor Advisory

Timeline

Published: Feb 21, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-466397.5A vulnerability in the descarga_etiqueta.php component of Correos Prestashop 1.7.x allows attackers to execute a directory traversal.CVE-2022-46645.4The Logo Slider WordPress plugin before 3.6.0 does not validate and escape some of its shortcode attributes before outputting them back in a CVE-2022-466409.8Nanoleaf Desktop App before v1.3.1 was discovered to contain a command injection vulnerability which is exploited via a crafted HTTP request CVE-2022-466419.9D-Link DIR-846 A1_FW100A43 was discovered to contain a command injection vulnerability via the lan(0)_dhcps_staticlist parameter in the SetI CVE-2022-466429.9D-Link DIR-846 A1_FW100A43 was discovered to contain a command injection vulnerability via the auto_upgrade_hour parameter in the SetAutoUpg CVE-2022-466455.5Uncontrolled resource consumption in the Intel(R) Smart Campus Android application before version 9.9 may allow an authenticated user to pot CVE-2022-466465.5Exposure of sensitive information to an unauthorized actor for some Intel Unison software may allow an authenticated user to potentially ena CVE-2022-466475.5Insertion of sensitive information into log file for some Intel Unison software may allow an authenticated user to potentially enable inform CVE-2022-466488.0ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a repos CVE-2022-466498.8Acemanager in ALEOS before version 4.16 allows a user with valid credentials to manipulate the IP logging operation to execute arbitrary she CVE-2022-46658.8Unrestricted Upload of File with Dangerous Type in GitHub repository ampache/ampache prior to 5.5.6.CVE-2022-466504.9Acemanager in ALEOS before version 4.16 allows a user with valid credentials to reconfigure the device to expose the ACEManager credentials