7.2
CVE-2022-40740
- EPSS 0.42%
- Veröffentlicht 03.01.2023 03:15:09
- Zuletzt bearbeitet 21.11.2024 07:21:57
- Quelle twcert@cert.org.tw
- Teams Watchlist Login
- Unerledigt Login
Realtek GPON router has insufficient filtering for special characters. A remote attacker authenticated as an administrator can exploit this vulnerability to perform command injection attacks, to execute arbitrary system command, manipulate system or disrupt service.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Realtek ≫ Xpon Software Development Kit Version1.9
Realtek ≫ Xpon Software Development Kit Version3.3
Realtek ≫ Xpon Software Development Kit Version4.0
Realtek ≫ Xpon Software Development Kit Version4.1
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.42% | 0.615 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| twcert@cert.org.tw | 7.2 | 1.2 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
|
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.