8.8

CVE-2022-44149

Exploit
The web service on Nexxt Amp300 ARN02304U8 42.103.1.5095 and 80.103.2.5045 devices allows remote OS command execution by placing &telnetd in the JSON host field to the ping feature of the goform/sysTools component. Authentication is required
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Nexxtsolutions ≫ Amp300 Firmware Version42.103.1.5095
   Nexxtsolutions ≫ Amp300 Version-
Nexxtsolutions ≫ Amp300 Firmware Version80.103.2.5045
   Nexxtsolutions ≫ Amp300 Version-
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 64.35% 0.991
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
134c704f-9b21-4f2e-91b3-4a467353bcc0 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

http://packetstormsecurity.com/files/170366/Nexxt-Router-Firmware-42.103.1.5095-Remote-Code-Execution.html
Third Party Advisory
Exploit
VDB Entry
http://packetstormsecurity.com/files/170366/Nexxt-Router-Firmware-80.103.2.5045-Remote-Code-Execution.html
Third Party Advisory
Exploit
VDB Entry
https://cxsecurity.com/issue/WLB-2023010006
Third Party Advisory
Exploit
https://packetstormsecurity.com/files/170366/Nexxt-Router-Firmware-42.103.1.5095-Remote-Code-Execution.html
Third Party Advisory
Exploit
VDB Entry
https://www.nexxtsolutions.com/connectivity/search/?q=ARN02304U8
Vendor Advisory
Product