Improper authentication in UNIMO Technology Co., Ltd UDR-JA1604/UDR-JA1608/UDR-JA1616
Priority MEDIUM 42CWE-287Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-287.
Summary
Improper authentication vulnerability in UDR-JA1604/UDR-JA1608/UDR-JA1616 firmware versions 71x10.1.107112.43A and earlier allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter the device settings.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00924 60th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| UNIMO Technology Co., Ltd | UDR-JA1604/UDR-JA1608/UDR-JA1616 | firmware versions 71x10.1.107112.43A and earlier | — | No fix listed | CNA |
- UDR-JA1604/UDR-JA1608/UDR-JA1616 VendorUNIMO Technology Co., Ltd Affected firmware versions 71x10.1.107112.43A and earlier Fixed in — No fix listed CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:unimo:udr-ja1604_firmware:*:*:*:*:*:*:*:* | before 71x10.1.107114.43a | Vulnerable | UNIMO Technology Co., Ltd |
| cpe:2.3:h:unimo:udr-ja1604:-:*:*:*:*:*:*:* | not specified by NVD | Running on | UNIMO Technology Co., Ltd |
| cpe:2.3:o:unimo:udr-ja1608_firmware:*:*:*:*:*:*:*:* | before 71x10.1.107114.43a | Vulnerable | UNIMO Technology Co., Ltd |
| cpe:2.3:h:unimo:udr-ja1608:-:*:*:*:*:*:*:* | not specified by NVD | Running on | UNIMO Technology Co., Ltd |
| cpe:2.3:o:unimo:udr-ja1616_firmware:*:*:*:*:*:*:*:* | before 71x10.1.107114.43a | Vulnerable | UNIMO Technology Co., Ltd |
| cpe:2.3:h:unimo:udr-ja1616:-:*:*:*:*:*:*:* | not specified by NVD | Running on | UNIMO Technology Co., Ltd |
- cpe:2.3:o:unimo:udr-ja1604_firmware:*:*:*:*:*:*:*:* Versions before 71x10.1.107114.43a Vulnerable ·UNIMO Technology Co., Ltd
- cpe:2.3:h:unimo:udr-ja1604:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·UNIMO Technology Co., Ltd
- cpe:2.3:o:unimo:udr-ja1608_firmware:*:*:*:*:*:*:*:* Versions before 71x10.1.107114.43a Vulnerable ·UNIMO Technology Co., Ltd
- cpe:2.3:h:unimo:udr-ja1608:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·UNIMO Technology Co., Ltd
- cpe:2.3:o:unimo:udr-ja1616_firmware:*:*:*:*:*:*:*:* Versions before 71x10.1.107114.43a Vulnerable ·UNIMO Technology Co., Ltd
- cpe:2.3:h:unimo:udr-ja1616:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·UNIMO Technology Co., Ltd
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2022-44620
- 2026-10-03 Alias added: GHSA-xmj9-xq4j-xh3h
References
More UNIMO Technology Co., Ltd Udr-ja1604 Firmware vulnerabilities
- TI-2022-21932 OS command injection in UNIMO Technology Co., Ltd UDR-JA1604/UDR-JA1608/UDR-JA1616 CVSS 3.1HIGH 8.8
- TI-2022-21256 OS command injection in UNIMO Technology Co., Ltd UDR-JA1604/UDR-JA1608/UDR-JA1616 CVSS 3.1HIGH 8.8
Sources
- CVE-2022-44620 · CVE Program
- CVE-2022-44620 · NVD
- FIRST EPSS
- GHSA-xmj9-xq4j-xh3h · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences