CVE-2022-50803
CriticalSummary
JM-DATA ONU JF511-TV w wersji 1.0.67 wykorzystuje domyślne dane logowania, co pozwala atakującym na uzyskanie nieautoryzowanego dostępu do urządzenia z uprawnieniami administratora.
Risk Assessment
Użycie domyślnych danych logowania stwarza poważne ryzyko dla bezpieczeństwa, umożliwiając atakującym pełną kontrolę nad urządzeniem i potencjalnie dostęp do sieci lokalnej.
Recommendation
Zaleca się natychmiastową zmianę domyślnych danych logowania na silne, unikalne hasła oraz regularne monitorowanie dostępu do urządzenia.
Related vulnerabilities
- CVE-2026-108540Critical
A flaw has been found in OpenSpug Spug up to 3.4.0/4.0.1, impacting the File Transfer component in the /exec/transfer file. Input manipulation can lead to OS command injection. The attack can be launched remotely and the exploit has been publicly disclosed.
- CVE-2026-108707Critical
Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header. Attackers gain HR administrator access to read payslips, salary history and employee personal data, download attachments, and modify or delete company-wide HR records.
- CVE-2026-81797Critical
The WordPress theme Buzz Stone | Magazine & Viral Blog in versions up to 1.0.2 contains a PHP Object Injection vulnerability. An unauthenticated attacker can inject a malicious PHP object, potentially leading to arbitrary code execution or other severe impacts.
- CVE-2026-78535Critical
The WordPress theme Photolia in versions up to 1.0.3 contains a PHP Object Injection vulnerability. An unauthenticated attacker can inject a malicious PHP object, potentially leading to arbitrary code execution or other severe impacts.
- CVE-2026-78533Critical
The WordPress theme Qwery in versions up to 3.6.1 contains a PHP Object Injection vulnerability. An unauthenticated attacker can inject a malicious PHP object, potentially leading to arbitrary code execution or other severe impacts.
- CVE-2026-78531Critical
The WordPress theme Jacqueline in versions up to 2.22 contains a PHP Object Injection vulnerability. An unauthenticated attacker can inject a malicious PHP object, potentially leading to arbitrary code execution or other severe impacts.
- CVE-2026-78529Critical
The WordPress theme Alliance in versions up to 3.11 contains a PHP Object Injection vulnerability. An unauthenticated attacker can inject a malicious PHP object, potentially leading to arbitrary code execution or other severe impacts.
- CVE-2026-66569Critical
The WordPress theme Kicker in versions up to 2.2.1 contains a PHP Object Injection vulnerability. An unauthenticated attacker can inject a malicious PHP object, potentially leading to arbitrary code execution or other severe impacts.
- CVE-2026-66568Critical
The WordPress theme Original in versions up to 1.9.0 contains a PHP Object Injection vulnerability. An unauthenticated attacker can inject a malicious PHP object, potentially leading to arbitrary code execution or other severe impacts.
- CVE-2026-66567Critical
The WordPress theme Anesta in versions up to 1.5.3 contains a PHP Object Injection vulnerability. An unauthenticated attacker can inject a malicious PHP object, potentially leading to arbitrary code execution or other severe impacts.
Original NVD description (English source)
JM-DATA ONU JF511-TV version 1.0.67 uses default credentials that allow attackers to gain unauthorized access to the device with administrative privileges.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS