Critical severity9.8NVD Advisory· Published Oct 6, 2022· Updated Jun 17, 2026

CVE-2022-40494

Description

NPS before v0.26.10 was discovered to contain an authentication bypass vulnerability via constantly generating and sending the Auth key and Timestamp parameters.

Affected products

Nps/npsllm-create2 versions
<0.26.10+ 1 more
- (no CPE)range: <0.26.10
- (no CPE)
Ehang Io/Nps
cpe:2.3:a:ehang-io:nps:*:*:*:*:*:*:*:*
Range: >=0.19.0,<=0.26.10

Patches

Vulnerability mechanics

References

blog.carrot2.cn/2022/08/cve-2022-40494.htmlnvdExploitThird Party Advisory
github.com/1security/Vulnerability/blob/main/web/nps/1.mdnvdBroken Link

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000