CVE-2022-46416

Parrot Bebop 4.7.1. allows remote attackers to prevent legitimate terminal connections by exhausting the DHCP IP address pool. To accomplish this, the attacker would first need to connect to the device's internal Wi-Fi network (e.g., by guessing the password). Then, the attacker would need to send many DHCP request packets.

CVSS v3 5.9 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/bosslabdcu/Vulnerability-Reporting/security/advisories/GHSA-4xx4-r27p-wcrv	Third Party Advisory
https://smartstore.naver.com/chachablues/products/6617613337	Product
https://smartstore.naver.com/hancomawesome-tech/products/5367473135	Product

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:parrot:bebop_firmware:4.7.1:*:*:*:*:*:*:*

cpe:2.3:h:parrot:bebop:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2023-03-27 21:15

Updated : 2024-02-28 20:13

NVD link : CVE-2022-46416

Mitre link : CVE-2022-46416

CVE.ORG link : CVE-2022-46416

JSON object : View

Products Affected

parrot

bebop_firmware
bebop

CWE

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2022-46416", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.2}, {"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 5.3, "exploitabilityScore": 3.1}]}, "published": "2023-03-27T21:15:10.100", "references": [{"url": "https://github.com/bosslabdcu/Vulnerability-Reporting/security/advisories/GHSA-4xx4-r27p-wcrv", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://smartstore.naver.com/chachablues/products/6617613337", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://smartstore.naver.com/hancomawesome-tech/products/5367473135", "tags": ["Product"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "Parrot Bebop 4.7.1. allows remote attackers to prevent legitimate terminal connections by exhausting the DHCP IP address pool. To accomplish this, the attacker would first need to connect to the device's internal Wi-Fi network (e.g., by guessing the password). Then, the attacker would need to send many DHCP request packets."}], "lastModified": "2023-04-03T17:08:38.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:parrot:bebop_firmware:4.7.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9C44E13E-1048-47BB-8542-DD1E256E12B6"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:parrot:bebop:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "00ECAD83-B5D8-4D21-97E0-3C6999533157"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}