CVEs-PoC/2022/CVE-2022-3229.md

CVE-2022-3229

Description

Because the web management interface for Unified Intents' Unified Remote solution does not itself require authentication, a remote, unauthenticated attacker can change or disable authentication requirements for the Unified Remote protocol, and leverage this now-unauthenticated access to run code of the attacker's choosing.

POC

Reference

• https://github.com/rapid7/metasploit-framework/pull/16989

Github

• https://github.com/ArtemioPadilla/unified-remote-tunnel