CVE-2022-40494

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-40494
NPS before v0.26.10 was discovered to contain an authentication bypass vulnerability via constantly generating and sending the Auth key and Timestamp parameters.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://blog.carrot2.cn/2022/08/cve-2022-40494.html Exploit Third Party Advisory
https://github.com/1security/Vulnerability/blob/main/web/nps/1.md Broken Link
https://blog.carrot2.cn/2022/08/cve-2022-40494.html Exploit Third Party Advisory
https://github.com/1security/Vulnerability/blob/main/web/nps/1.md Broken Link
Configurations

Configuration 1 (hide)

cpe:2.3:a:ehang-io:nps:*:*:*:*:*:*:*:*
History

17 Apr 2025, 14:55

Type Values Removed Values Added
CPE cpe:2.3:a:nps_project:nps:*:*:*:*:*:*:*:* cpe:2.3:a:ehang-io:nps:*:*:*:*:*:*:*:*
First Time Ehang-io
Ehang-io nps
Information

Published : 2022-10-06 22:15

Updated : 2025-04-17 14:55

NVD link : CVE-2022-40494

Mitre link : CVE-2022-40494

CVE.ORG link : CVE-2022-40494

JSON object : View

Products Affected

ehang-io

  • nps
CWE
CWE-287

Improper Authentication