Security readout for executives and security teams
Plain-English summary
CVE-2022-50804 is a CSRF flaw in JM-DATA ONU JF511-TV firmware that could let an attacker make an authenticated administrator unknowingly perform device management actions. Business urgency is highest where these ONUs are remotely managed or reachable from user browsing environments. Public sources list exploit material, but the bundle does not show CISA KEV or confirmed active exploitation.
Executive priority
Treat as a high-priority network device risk if these ONUs are in use. Prioritize exposure reduction and vendor remediation checks. If affected devices support customer or production connectivity, plan maintenance or isolation because administrative misuse could affect service confidentiality, settings integrity, or availability.
Technical view
The issue is CWE-352 cross-site request forgery affecting JM-DATA ONU JF511-TV versions listed as 1.0.67, 1.0.62, and 1.0.55. CVSS 3.1 is 8.8: network attack vector, low complexity, no attacker privileges, user interaction required, with high confidentiality, integrity, and availability impact.
Likely exposure
Exposure is likely limited to organizations using JM-DATA ONU JF511-TV devices, especially if administrative web interfaces are reachable from untrusted networks or administrators browse the web while authenticated. The source bundle does not provide deployment prevalence or internet exposure counts.
Exploitation context
The attack requires enticing an authenticated administrator to load attacker-controlled content while logged into the device. Public exploit listings exist in the provided references. Active exploitation is not established because the CVE is not marked KEV and no cited source in the bundle confirms in-the-wild use.
Researcher notes
The record is source-backed by CVE, VulnCheck, Zero Science Lab, and vulnerability database entries. The bundle lists multiple affected versions, while the title emphasizes 1.0.67. No official patch details are provided here. Avoid assuming active exploitation despite public exploit references.
Mitigation direction
- Check JM-DATA guidance for firmware updates or official mitigations.
- Restrict administrative interface access to trusted management networks only.
- Require administrators to log out after device administration sessions.
- Avoid browsing untrusted sites while authenticated to device management pages.
- Inventory affected firmware versions and prioritize replacement or isolation if no fix exists.
Validation and detection
- Identify JM-DATA ONU JF511-TV devices in network and asset inventories.
- Confirm firmware versions against 1.0.67, 1.0.62, and 1.0.55.
- Review whether management interfaces are reachable from user or internet-facing networks.
- Check vendor and advisory pages for updated remediation status.
- Monitor logs for unexpected administrative configuration changes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-352: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-50804 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H2.85.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- Zero Science Lab Disclosure (ZSL-2022-5708)CVE reference · third-party-advisory
- Packet Storm Security Exploit EntryCVE reference · exploit
- CXSecurity Vulnerability ListingCVE reference · third-party-advisory
- IBM X-Force Vulnerability Exchange EntryCVE reference · vdb-entry
- JM-DATA Vendor HomepageCVE reference · product
- VulnCheck Advisory: JM-DATA ONU JF511-TV 1.0.67 Cross-Site Request Forgery (CSRF) VulnerabilityCVE reference · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.