CVE-2022-31210

9.8 criticalEPSS 1.1%

Critical (9.8) in infiray iray-a8z3 firmware. EPSS 1.1% chance of exploitation in the next 30 days.

An issue was discovered in Infiray IRAY-A8Z3 1.0.957. The binary file /usr/local/sbin/webproject/set_param.cgi contains hardcoded credentials to the web application. Because these accounts cannot be deactivated or have their passwords changed, they are considered to be backdoor accounts.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.1% chance of exploitation in the next 30 days; higher than 66% of CVEs (scores of 2026-10-31)
CWE: CWE-798
Published: 2022-07-17
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

infiray:iray-a8z3_firmware

References

https://sec-consult.com/vulnerability-lab/advisory/infiray-iray-thermal-camera-multiple-vulnerabilities/
https://sec-consult.com/vulnerability-lab/advisory/infiray-iray-thermal-camera-multiple-vulnerabilities/

Check your stack JSON