CVE-2022-45227 - Vulnerability Details - OpenCVE

The web portal of Dragino Lora LG01 18ed40 IoT v4.3.4 has the directory listing at the URL https://10.10.20.74/lib/. This address has a backup file which can be downloaded without any authentication.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Dragino	Lg01 Lora Lg01 Lora Firmware

Configuration 1 [-]

AND

cpe:2.3:o:dragino:lg01_lora_firmware:4.3.4:*:*:*:*:*:*:*

cpe:2.3:h:dragino:lg01_lora:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://sectrio.com/vulnerability-research/cve-2022-45227/

History

Wed, 23 Apr 2025 14:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2022-12-12T00:00:00.000Z

Updated: 2025-04-23T13:45:11.292Z

Reserved: 2022-11-14T00:00:00.000Z

Link: CVE-2022-45227

Vulnrichment

Updated: 2024-08-03T14:09:56.598Z

NVD

Status : Modified

Published: 2022-12-12T03:15:09.483

Modified: 2025-04-23T14:15:25.557

Link: CVE-2022-45227

Redhat

No data.

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dragino:lg01_lora_firmware:4.3.4:*:*:*:*:*:*:*", "matchCriteriaId": "6A2830AE-101B-49F6-AABB-1380DF547124", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dragino:lg01_lora:-:*:*:*:*:*:*:*", "matchCriteriaId": "90700E39-13D8-4649-B2E8-EBF17ABD18D2", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The web portal of Dragino Lora LG01 18ed40 IoT v4.3.4 has the directory listing at the URL https://10.10.20.74/lib/. This address has a backup file which can be downloaded without any authentication."}, {"lang": "es", "value": "El portal web de Dragino Lora LG01 18ed40 IoT v4.3.4 tiene el directorio listado en la URL https://10.10.20.74/lib/. Esta direcci\u00f3n tiene un archivo de respaldo que se puede descargar sin ninguna autenticaci\u00f3n."}], "id": "CVE-2022-45227", "lastModified": "2025-04-23T14:15:25.557", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2022-12-12T03:15:09.483", "references": [{"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://sectrio.com/vulnerability-research/cve-2022-45227/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://sectrio.com/vulnerability-research/cve-2022-45227/"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-552"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-552"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}