CVE-2022-29525

CRITICAL

Rakuten Casa AP_F_V1_4_1 and AP_F_V2_0_0 - Unauthenticated Use of Hard-coded Credentials

Title source: llm
STIX 2.1

Description

Rakuten Casa version AP_F_V1_4_1 or AP_F_V2_0_0 uses a hard-coded credential which may allow a remote unauthenticated attacker to log in with the root privilege and perform an arbitrary operation.

References (2)

Core 2
Core References
Third Party Advisory, VDB Entry x_refsource_misc
https://jvn.jp/en/jp/JVN46892984/index.html

Scores

CVSS v3 9.8
EPSS 0.0142
EPSS Percentile 69.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-798
Status published
Products (2)
rakuten/casa ap_f_v1_4_1
rakuten/casa ap_f_v2_0_0
Published Jun 13, 2022
Tracked Since Feb 18, 2026