CVE-2022-36228 - Vulnerability Details - OpenCVE

Nokelock Smart padlock O1 Version 5.3.0 is vulnerable to Insecure Permissions. By sending a request, you can add any device and set the device password in the Nokelock app.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00065.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Janusintl	Noke Hd\+ Smart Padlock Noke Hd\+ Smart Padlock Firmware Noke Hd Smart Padlock Noke Hd Smart Padlock Firmware Noke Standard Smart Padlock Noke Standard Smart Padlock Firmware

Configuration 1 [-]

AND

cpe:2.3:o:janusintl:noke_standard_smart_padlock_firmware:5.3.0:*:*:*:*:*:*:*

cpe:2.3:h:janusintl:noke_standard_smart_padlock:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:janusintl:noke_hd_smart_padlock_firmware:5.3.0:*:*:*:*:*:*:*

cpe:2.3:h:janusintl:noke_hd_smart_padlock:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:janusintl:noke_hd\+_smart_padlock_firmware:5.3.0:*:*:*:*:*:*:*

cpe:2.3:h:janusintl:noke_hd\+_smart_padlock:-:*:*:*:*:*:*:*

No data.

No data.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://gist.github.com/YTrick/59c06611052d3fdae034e7087293bbc0

History

Wed, 30 Oct 2024 15:15:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'}`	cvssV3_1 `{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L'}`

Thu, 19 Sep 2024 16:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2023-10-09T00:00:00

Updated: 2024-10-30T14:21:56.998Z

Reserved: 2022-07-18T00:00:00

Link: CVE-2022-36228

Vulnrichment

Updated: 2024-08-03T10:00:04.262Z

NVD

Status : Modified

Published: 2023-10-09T21:15:09.850

Modified: 2024-11-21T07:12:37.887

Link: CVE-2022-36228

Redhat

No data.

OpenCVE Enrichment

No data.

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:janusintl:noke_standard_smart_padlock_firmware:5.3.0:*:*:*:*:*:*:*", "matchCriteriaId": "2DD7E2BB-06DC-4795-8993-2FF4A65CF5C7", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:janusintl:noke_standard_smart_padlock:-:*:*:*:*:*:*:*", "matchCriteriaId": "B8CBCFAF-1E3C-4D23-AB50-E507FAE01B81", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:janusintl:noke_hd_smart_padlock_firmware:5.3.0:*:*:*:*:*:*:*", "matchCriteriaId": "CE70B568-0FD5-410F-BE40-8E8C2F287595", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:janusintl:noke_hd_smart_padlock:-:*:*:*:*:*:*:*", "matchCriteriaId": "2E583B74-1A27-4436-B437-32AF666E5559", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:janusintl:noke_hd\\+_smart_padlock_firmware:5.3.0:*:*:*:*:*:*:*", "matchCriteriaId": "CDDB5B2B-82AD-4DD5-A05E-04696B7143AC", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:janusintl:noke_hd\\+_smart_padlock:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2226C90-60C4-468F-9161-0AF6C384DF2D", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "Nokelock Smart padlock O1 Version 5.3.0 is vulnerable to Insecure Permissions. By sending a request, you can add any device and set the device password in the Nokelock app."}, {"lang": "es", "value": "Nokelock Smart padlock O1 versi\u00f3n 5.3.0 es vulnerable a permisos inseguros. Al enviar una solicitud, puede agregar cualquier dispositivo y configurar la contrase\u00f1a del dispositivo en la aplicaci\u00f3n Nokelock."}], "id": "CVE-2022-36228", "lastModified": "2024-11-21T07:12:37.887", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2023-10-09T21:15:09.850", "references": [{"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://gist.github.com/YTrick/59c06611052d3fdae034e7087293bbc0"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://gist.github.com/YTrick/59c06611052d3fdae034e7087293bbc0"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "nvd@nist.gov", "type": "Primary"}]}