Vulnerability Details CVE-2022-45636
An issue discovered in MEGAFEIS, BOFEI DBD+ Application for IOS & Android v1.4.4 allows attacker to unlock model(s) without authorization via arbitrary API requests.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 34.5%
CVSS Severity
CVSS v3 Score 8.1
References
- https://github.com/WithSecureLabs/megafeis-palm/tree/main/CVE-2022-45636
- https://labs.withsecure.com/advisories/insecure-authorization-scheme-for-api-requests-in-dbd--mobile-co
- https://github.com/WithSecureLabs/megafeis-palm/tree/main/CVE-2022-45636
- https://labs.withsecure.com/advisories/insecure-authorization-scheme-for-api-requests-in-dbd--mobile-co
Products affected by CVE-2022-45636
-
cpe:2.3:a:megafeis:bofei_dbd+:1.4.3
-
cpe:2.3:a:megafeis:bofei_dbd+:1.4.4