CVE-2022-2827

AMI MegaRAC User Enumeration Vulnerability

Severity Score

7.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

AMI MegaRAC User Enumeration Vulnerability

Vulnerabilidad de enumeración de usuarios de AMI MegaRAC

*Credits: Vlad Babkin from Eclypsium Research

CVSS Scores

NISTv3.1 7.5

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2022-08-15 CVE Reserved
2022-12-05 CVE Published
2024-06-27 EPSS Updated
2024-08-03 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

CAPEC

CAPEC-114: Authentication Abuse
CAPEC-169: Footprinting

References (1)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023001.pdf	2023-02-28

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Ami Search vendor "Ami"		Megarac Sp-x Search vendor "Ami" for product "Megarac Sp-x"				12 Search vendor "Ami" for product "Megarac Sp-x" and version "12"		-		Affected
Ami Search vendor "Ami"		Megarac Sp-x Search vendor "Ami" for product "Megarac Sp-x"				13 Search vendor "Ami" for product "Megarac Sp-x" and version "13"		-		Affected