7.2
CVE-2022-40740
- EPSS 0.42%
- Published 03.01.2023 03:15:09
- Last modified 21.11.2024 07:21:57
- Source twcert@cert.org.tw
- Teams watchlist Login
- Open Login
Realtek GPON router has insufficient filtering for special characters. A remote attacker authenticated as an administrator can exploit this vulnerability to perform command injection attacks, to execute arbitrary system command, manipulate system or disrupt service.
Data is provided by the National Vulnerability Database (NVD)
Realtek ≫ Xpon Software Development Kit Version1.9
Realtek ≫ Xpon Software Development Kit Version3.3
Realtek ≫ Xpon Software Development Kit Version4.0
Realtek ≫ Xpon Software Development Kit Version4.1
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.42% | 0.615 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| twcert@cert.org.tw | 7.2 | 1.2 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
|
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.