CVE-2022-40259 - Vulnerability Details - OpenCVE

MegaRAC Default Credentials Vulnerability

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Ami	Megarac Sp-x

Configuration 1 [-]

OR	cpe:2.3:o:ami:megarac_sp-x:12:::::::*
	cpe:2.3:o:ami:megarac_sp-x:13:::::::*

No data.

References

Link	Providers
https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023001.pdf

History

Wed, 23 Apr 2025 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: certcc

Published: 2022-12-05T21:33:13.256Z

Updated: 2025-04-23T14:54:39.659Z

Reserved: 2022-09-08T19:14:18.696Z

Link: CVE-2022-40259

Vulnrichment

Updated: 2024-08-03T12:14:39.961Z

NVD

Status : Modified

Published: 2022-12-05T22:15:10.857

Modified: 2024-11-21T07:21:08.797

Link: CVE-2022-40259

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2022-40259", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "state": "PUBLISHED", "assignerShortName": "certcc", "requesterUserId": "b7e00183-089e-4194-bbe8-4b7d6adf6c7f", "dateReserved": "2022-09-08T19:14:18.696Z", "datePublished": "2022-12-05T21:33:13.256Z", "dateUpdated": "2025-04-23T14:54:39.659Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "MegaRAC SPx12", "vendor": "AMI", "versions": [{"lessThanOrEqual": "SPx12-update-6.00", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "MegaRAC SPx13", "vendor": "AMI", "versions": [{"lessThanOrEqual": "SPx13-update-4.00", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Vlad Babkin from Eclypsium Research"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "MegaRAC Default Credentials Vulnerability"}], "value": "MegaRAC Default Credentials Vulnerability"}], "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115 Authentication Bypass"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-798", "description": "CWE-798 Use of Hard-coded Credentials", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2023-01-31T18:20:13.979Z"}, "references": [{"url": "https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023001.pdf"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "AMI-SA-2023001<br>"}], "value": "AMI-SA-2023001\n"}], "source": {"advisory": "AMI-SA-2023001", "discovery": "EXTERNAL"}, "title": "MegaRAC Default Credentials Vulnerability", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T12:14:39.961Z"}, "title": "CVE Program Container", "references": [{"url": "https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023001.pdf", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-23T14:54:06.111766Z", "id": "CVE-2022-40259", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-23T14:54:39.659Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023001.pdf", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T12:14:39.961Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-40259", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-04-23T14:54:06.111766Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-23T14:54:35.658Z"}}], "cna": {"title": "MegaRAC Default Credentials Vulnerability", "source": {"advisory": "AMI-SA-2023001", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Vlad Babkin from Eclypsium Research"}], "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115 Authentication Bypass"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "AMI", "product": "MegaRAC SPx12", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "SPx12-update-6.00"}], "defaultStatus": "unaffected"}, {"vendor": "AMI", "product": "MegaRAC SPx13", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "SPx13-update-4.00"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "AMI-SA-2023001\n", "supportingMedia": [{"type": "text/html", "value": "AMI-SA-2023001<br>", "base64": false}]}], "references": [{"url": "https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023001.pdf"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "MegaRAC Default Credentials Vulnerability", "supportingMedia": [{"type": "text/html", "value": "MegaRAC Default Credentials Vulnerability", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-798", "description": "CWE-798 Use of Hard-coded Credentials"}]}], "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2023-01-31T18:20:13.979Z"}}}, "cveMetadata": {"cveId": "CVE-2022-40259", "state": "PUBLISHED", "dateUpdated": "2025-04-23T14:54:39.659Z", "dateReserved": "2022-09-08T19:14:18.696Z", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "datePublished": "2022-12-05T21:33:13.256Z", "requesterUserId": "b7e00183-089e-4194-bbe8-4b7d6adf6c7f", "assignerShortName": "certcc"}, "dataVersion": "5.1"}