CVE-2022-28704: Critical severity rakuten casa vulnerability

Published Jun 13, 2022

Updated

Improper access control vulnerability in Rakuten Casa version APFV141 or APFV200 allows a remote attacker to log in with the root privilege and perform an arbitrary operation if the product is in its default settings in which is set to accept SSH connections from the WAN side, and is also connected to the Internet with the authentication information unchanged from the default settings.

Affected Software

2 affected components

Rakuten Casa=ap_f_v1_4_1

Rakuten Casa=ap_f_v2_0_0

Event History

Jun 13, 2022

CVE Published

via MITRE·04:50 AM

Data Sourced

via MITRE·04:50 AM

DescriptionWeakness

Frequently Asked Questions

What is the vulnerability ID?

The vulnerability ID is CVE-2022-28704.

What is the severity of CVE-2022-28704?

The severity of CVE-2022-28704 is critical with a CVSS score of 7.2.

Which software versions are affected by CVE-2022-28704?

Rakuten Casa versions AP_F_V1_4_1 and AP_F_V2_0_0 are affected by CVE-2022-28704.

How does the vulnerability in Rakuten Casa allow unauthorized access?

The vulnerability allows a remote attacker to log in with root privilege and perform arbitrary operations if the product is in its default settings and set to accept SSH connections from the WAN side.

How can I fix the vulnerability in Rakuten Casa?

To fix the vulnerability, update Rakuten Casa to a version that is not affected, as advised by the vendor.