CVE-2022-40895

In certain Nedi products, a vulnerability in the web UI of NeDi login & Community login could allow an unauthenticated, remote attacker to affect the integrity of a device via a User Enumeration vulnerability. The vulnerability is due to insecure design, where a difference in forgot password utility could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users. This affects NeDi 1.0.7 for OS X 1.0.7 <= and NeDi for Suse 1.0.7 <= and NeDi for FreeBSD 1.0.7 <=.

• CWE-203

• http://forum.nedi.ch/index.phpVendor Advisory
• https://gist.github.com/UditChavda/2f2effa477a429b485ae7e2dc3bbd04fExploit, Third Party Advisory
• https://www.nedi.ch/Vendor Advisory
• http://forum.nedi.ch/index.phpVendor Advisory
• https://gist.github.com/UditChavda/2f2effa477a429b485ae7e2dc3bbd04fExploit, Third Party Advisory
• https://www.nedi.ch/Vendor Advisory

Published

Oct 6, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-40885Bento4 v1.6.0-639 has a memory allocation issue that can cau…5.5
• CVE-2022-40886DedeCMS 5.7.98 has a file upload vulnerability in the backgr…7.2
• CVE-2022-40887SourceCodester Best Student Result Management System 1.0 is …9.8
• CVE-2022-40889Phpok 6.1 has a deserialization vulnerability via framework/…9.8
• CVE-2022-4089A vulnerability was found in rickxy Stock Management System.…5.4
• CVE-2022-40890A vulnerability in /src/amf/amf-context.c in Open5GS 2.4.10 …7.5
• CVE-2022-40896A ReDoS issue was discovered in pygments/lexers/smithy.py in…5.5
• CVE-2022-40897Python Packaging Authority (PyPA) setuptools before 65.5.1 a…5.9
• CVE-2022-40898An issue discovered in Python Packaging Authority (PyPA) Whe…7.5
• CVE-2022-40899An issue discovered in Python Charmers Future 0.18.2 and ear…7.5
• CVE-2022-4090A vulnerability was found in rickxy Stock Management System …8.8
• CVE-2022-40903Aiphone GT-DMB-N 3-in-1 Video Entrance Station with NFC Read…6.5