← Advisories

JM-DATA ONU JF511-TV Multiple Remote Vulnerabilities

High
Advisory ID
ZSL-2022-5708
Release Date
14 June 2022
Vendor
JM-DATA GmbH - https://www.jm-data.at
Affected Version
1.0.67, 1.0.62, 1.0.55
CVE
CVE-2022-50801, CVE-2022-50803, CVE-2022-50804
Tested On
Boa/0.93.15
Summary

This ONU is the perfect GEPON home and business gateway. It is an all-rounder in perfection. It can BRIDGE/NAT/RIP ROUTEND and COMBINED.

Description

The device suffers from multiple vulnerabilities including: Default Credentials, CSRF, Authenticated Stored XSS and Open Redirect.

Proof of Concept
jm_data-JF511-TV_info.txtTXT
Disclosure Timeline
N/A
Credits
Vulnerability discovered by Neurogenesia
References
[1]https://packetstormsecurity.com/files/167487/
[2]https://cxsecurity.com/issue/WLB-2022060058
[3]https://exchange.xforce.ibmcloud.com/vulnerabilities/229355
[4]https://exchange.xforce.ibmcloud.com/vulnerabilities/229356
[5]https://exchange.xforce.ibmcloud.com/vulnerabilities/229344
[6]https://exchange.xforce.ibmcloud.com/vulnerabilities/229343
[7]https://www.cve.org/CVERecord?id=CVE-2022-50801
[8]https://www.cve.org/CVERecord?id=CVE-2022-50803
[9]https://www.cve.org/CVERecord?id=CVE-2022-50804
Changelog
14.06.2022Initial release
21.06.2022Added reference [1]
23.06.2022Added reference [2], [3], [4], [5] and [6]
24.03.2026Added reference [7], [8] and [9]