medium5.9Public exploit code
CVE-2022-29593
relay_cgi.cgi on Dingtian DT-R002 2CH relay devices with firmware 3.1.276A allows an attacker to replay HTTP post requests without the need for authentication …
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Dingtian-DT-R002 3.1.276A - Authentication Bypass2022-07-29 · webapps · hardware
Impact
relay_cgi.cgi on Dingtian DT-R002 2CH relay devices with firmware 3.1.276A allows an attacker to replay HTTP post requests without the need for authentication or a valid signed/authorized request.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Dingtian-Tech | Dt-R004 Firmware | Version 3.1.276a |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/167868/Dingtian-DT-R002-3.1.276A-Authentication-Bypass.html
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/cve-2022-29593-authentication-bypass-by-capture-replay-dingtian-dt-r002/
- https://www.trustwave.com/en-us/resources/security-resources/security-advisories/
- http://packetstormsecurity.com/files/167868/Dingtian-DT-R002-3.1.276A-Authentication-Bypass.html
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/cve-2022-29593-authentication-bypass-by-capture-replay-dingtian-dt-r002/
- https://www.trustwave.com/en-us/resources/security-resources/security-advisories/