CVE-2022-34850

2022-10-2517:15:53

CWE-78

[email protected]

web.nvd.nist.gov

command injection

web_server

robustel r1510

network request

arbitrary command execution

vulnerability

attacker

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

0.002

Percentile

59.2%

JSON

An OS command injection vulnerability exists in the web_server /action/import_authorized_keys/ functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network request can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger this vulnerability.

Affected configurations

Nvd

Node

robustelr1510_firmwareMatch3.1.16

robustelr1510_firmwareMatch3.3.0

AND

robustelr1510Match-

VendorProductVersionCPE
robustelr1510_firmware3.1.16cpe:2.3:o:robustel:r1510_firmware:3.1.16:*:*:*:*:*:*:*
robustelr1510_firmware3.3.0cpe:2.3:o:robustel:r1510_firmware:3.3.0:*:*:*:*:*:*:*
robustelr1510-cpe:2.3:h:robustel:r1510:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
robustel	r1510_firmware	3.1.16	cpe:2.3:o:robustel:r1510_firmware:3.1.16:::::::*
robustel	r1510_firmware	3.3.0	cpe:2.3:o:robustel:r1510_firmware:3.3.0:::::::*
robustel	r1510	-	cpe:2.3:h:robustel:r1510:-:::::::*