CVE-2022-26672CWE-798

ASUS WebStorage - Use of Hard-coded Credentials

High · published April 22, 2022

CVSS v3.1
7.3
EPSS
1%
Percentile
67.9
In the wild
Unconfirmed
What it is

ASUS WebStorage has a hardcoded API Token in the APP source code. An unauthenticated remote attacker can use this token to establish connections with the server and carry out login attempts to general user accounts. A successful login to a general user account allows the attacker to access, modify or delete this user account information.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.01198 · 67.9th percentile
Weakness
CWE-798 · Use of Hard-coded Credentials
Published
2022-04-22T06:50Z
EPSS history
Timeline
  • 22 APR 06:50Z
    ASUS WebStorage - Use of Hard-coded Credentials
    cvelistv5