CVE-2022-36158

Contec FXA3200 version 1.13.00 and under suffers from Insecure Permissions in the Wireless LAN Manager interface which allows malicious actors to execute Linux commands with root privilege via a hidden web page (/usr/www/ja/mnt_cmd.cgi).

• CWE-425
• CWE-425

• https://gist.github.com/Nwqda/aac33d1936d2b514a3268f145345abb4Broken Link, Third Party Advisory
• https://jvn.jp/en/vu/JVNVU98305100/Patch, Third Party Advisory
• https://samy.link/blog/contec-flexlan-fxa2000-and-fxa3000-series-vulnerability-repoExploit, Mitigation, Third Party Advisory
• https://www.contec.com/products-services/computer-networking/flexlan-fx/fx-accesspoint/fxa3200/feature/#sectionProduct
• https://gist.github.com/Nwqda/aac33d1936d2b514a3268f145345abb4Broken Link, Third Party Advisory
• https://jvn.jp/en/vu/JVNVU98305100/Patch, Third Party Advisory
• https://samy.link/blog/contec-flexlan-fxa2000-and-fxa3000-series-vulnerability-repoExploit, Mitigation, Third Party Advisory
• https://www.contec.com/products-services/computer-networking/flexlan-fx/fx-accesspoint/fxa3200/feature/#sectionProduct

Published

Sep 26, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-36150tifig v0.2.2 was discovered to contain a heap-buffer overflo…5.5
• CVE-2022-36151tifig v0.2.2 was discovered to contain a segmentation violat…5.5
• CVE-2022-36152tifig v0.2.2 was discovered to contain a memory leak via ope…5.5
• CVE-2022-36153tifig v0.2.2 was discovered to contain a segmentation violat…5.5
• CVE-2022-36155tifig v0.2.2 was discovered to contain a resource allocation…5.5
• CVE-2022-36157XXL-JOB all versions as of 11 July 2022 are vulnerable to In…8.8
• CVE-2022-36159Contec FXA3200 version 1.13 and under were discovered to con…8.8
• CVE-2022-3616Attackers can create long chains of CAs that would lead to O…7.5
• CVE-2022-36161Orange Station 1.0 was discovered to contain a SQL injection…9.8
• CVE-2022-36168A directory traversal vulnerability was discovered in Wuzhic…2.7
• CVE-2022-36170MapGIS 10.5 Pro IGServer has hardcoded credentials in the fr…8.8
• CVE-2022-36171MapGIS IGServer 10.5.6.11 is vulnerable to Arbitrary file de…8.1