Security readout for executives and security teams
Plain-English summary
CHCNAV P5E GNSS version 4.2 can expose the device access point name and password in clear text through an API path. This is a moderate business risk because exposed wireless credentials can weaken field device security, but the CVSS data indicates local access and low privileges are required.
Executive priority
Treat this as a moderate-priority field device exposure issue. Prioritize affected devices on shared, contractor, or operational networks, and confirm vendor remediation before relying on credential rotation alone.
Technical view
The CVE describes an insecure API behavior in CHCNAV P5E GNSS 4.2 where Wi-Fi access point details, including a cleartext password, are returned. CVSS 3.1 score is 6.3 with local attack vector, low complexity, low privileges, no user interaction, changed scope, and low confidentiality, integrity, and availability impact.
Likely exposure
Exposure is limited to organizations using CHCNAV P5E GNSS version 4.2. Risk is higher where device management or API surfaces are reachable from shared local networks or by low-privileged users.
Exploitation context
The source bundle does not show CISA KEV listing or cited evidence of active exploitation. The public description confirms credential exposure behavior, but does not provide exploit prevalence, patch status, or observed attacks.
Researcher notes
Evidence is sparse. The record identifies one affected product/version and one cleartext credential exposure behavior, but no CWE, patch version, workaround, or active exploitation source is provided.
Mitigation direction
- Inventory CHCNAV P5E GNSS devices and confirm firmware version 4.2.
- Check CHCNAV and gov.il advisory guidance for vendor-supported fixes.
- Restrict device management/API access to trusted local administrators.
- Rotate exposed Wi-Fi credentials after remediation or reconfiguration.
- Segment GNSS devices from general user and guest networks.
Validation and detection
- Verify whether any CHCNAV P5E GNSS devices run version 4.2.
- Review network access controls around device management interfaces.
- In an authorized test, confirm whether Wi-Fi credentials are exposed by the documented API behavior.
- Check logs for unexpected local access to device configuration interfaces.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Credential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2022-30626 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L23.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.3MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Source materials
- CVE List V5 sourceCVE List V5
- https://www.gov.il/en/Departments/faq/cve_advisoriesCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.