CVE-2022-42982
Last modified
CVE-2022-42982 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. BKG Professional NtripCaster 2.0.39 allows querying information over the UDP protocol without authentication. The NTRIP sourcetable is typically quite long (tens of kBs) and can be requested with a packet of only 30 bytes. EPSS estimates a 0.66% chance of exploitation in the next 30 days.
Description
BKG Professional NtripCaster 2.0.39 allows querying information over the UDP protocol without authentication. The NTRIP sourcetable is typically quite long (tens of kBs) and can be requested with a packet of only 30 bytes. This presents a vector that can be used for UDP amplification attacks. Normally, only authenticated streaming data will be provided over UDP and not the sourcetable.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Bund | Bkg Professional Ntripcaster | <= 2.0.39 |
References
- https://cve.mahi.be/bkg_ntrip_udp/Third Party Advisory
- https://igs.bkg.bund.de/ntrip/bkgcasterProduct, Vendor Advisory
- https://cve.mahi.be/bkg_ntrip_udp/Third Party Advisory
- https://igs.bkg.bund.de/ntrip/bkgcasterProduct, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-42982?
How severe is CVE-2022-42982?
How do I fix CVE-2022-42982?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-42975socket/transport.ex in Phoenix before 1.6.14 mishandles chec…7.5
- CVE-2022-42977The Netic User Export add-on before 1.3.5 for Atlassian Conf…7.5
- CVE-2022-42978In the Netic User Export add-on before 1.3.5 for Atlassian C…7.5
- CVE-2022-42979Information disclosure due to an insecure hostname validatio…8.8
- CVE-2022-4298The Wholesale Market WordPress plugin before 2.2.1 does not …9.8
- CVE-2022-42980go-admin (aka GO Admin) 2.0.12 uses the string go-admin as a…9.8
- CVE-2022-42983anji-plus AJ-Report 0.9.8.6 allows remote attackers to bypas…8.8
- CVE-2022-42984WoWonder Social Network Platform 4.1.4 was discovered to con…9.8
- CVE-2022-42985The ScratchLogin extension through 1.1 for MediaWiki does no…4.8
- CVE-2022-42986Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2022-42989ERP Sankhya before v4.11b81 was discovered to contain a cros…9
- CVE-2022-4299The Metricool WordPress plugin before 1.18 does not sanitise…4.8
Are you affected by CVE-2022-42982?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST