{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-40740", "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "assignerShortName": "twcert", "dateUpdated": "2024-08-03T12:28:41.521Z", "dateReserved": "2022-09-15T00:00:00", "datePublished": "2023-01-03T00:00:00"}, "containers": {"cna": {"title": "Realtek GPON router - Command Injection", "datePublic": "2022-12-30T00:00:00", "providerMetadata": {"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "shortName": "twcert", "dateUpdated": "2023-01-03T00:00:00"}, "descriptions": [{"lang": "en", "value": "Realtek GPON router has insufficient filtering for special characters. A remote attacker authenticated as an administrator can exploit this vulnerability to perform command injection attacks, to execute arbitrary system command, manipulate system or disrupt service."}], "affected": [{"vendor": "Realtek", "product": "GPON router", "versions": [{"version": "SDK 1.9", "status": "affected"}]}], "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-6831-19121-1.html"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-78 OS Command Injection", "cweId": "CWE-78"}]}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "source": {"advisory": "TVN-202212004", "discovery": "EXTERNAL"}, "solutions": [{"lang": "en", "value": "Contact tech support from Realtek"}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T12:28:41.521Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-6831-19121-1.html", "tags": ["x_transferred"]}]}]}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:realtek:usdk:1.0:*:*:*:*:*:*:*", "matchCriteriaId": "57135300-34FE-47A4-9493-38C59038D1D9", "vulnerable": true}, {"criteria": "cpe:2.3:a:realtek:usdk:2.0:*:*:*:*:*:*:*", "matchCriteriaId": "1CCEF00B-90C7-4079-AE9D-18F4B8F7EF06", "vulnerable": true}, {"criteria": "cpe:2.3:a:realtek:usdk:2.2:*:*:*:*:*:*:*", "matchCriteriaId": "8230CFDF-47B5-430B-97BF-6C4A62DE9F08", "vulnerable": true}, {"criteria": "cpe:2.3:a:realtek:xpon_software_development_kit:1.9:*:*:*:*:*:*:*", "matchCriteriaId": "CBBA9129-7E09-405E-B6FF-567A4DEBD549", "vulnerable": true}, {"criteria": "cpe:2.3:a:realtek:xpon_software_development_kit:3.3:*:*:*:*:*:*:*", "matchCriteriaId": "0926C831-6BAD-499F-ABEB-ACE999EF1D65", "vulnerable": true}, {"criteria": "cpe:2.3:a:realtek:xpon_software_development_kit:4.0:*:*:*:*:*:*:*", "matchCriteriaId": "12E595EC-531C-44A9-BC81-2B852DF6C9E9", "vulnerable": true}, {"criteria": "cpe:2.3:a:realtek:xpon_software_development_kit:4.1:*:*:*:*:*:*:*", "matchCriteriaId": "98BC0768-C674-4E64-8BED-EB7A10846D8A", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Realtek GPON router has insufficient filtering for special characters. A remote attacker authenticated as an administrator can exploit this vulnerability to perform command injection attacks, to execute arbitrary system command, manipulate system or disrupt service."}, {"lang": "es", "value": "El router Realtek GPON tiene un filtrado insuficiente para caracteres especiales. Un atacante remoto autenticado como administrador puede aprovechar esta vulnerabilidad para realizar ataques de inyecci\u00f3n de comandos, ejecutar comandos arbitrarios del sistema, manipular el sistema o interrumpir el servicio."}], "id": "CVE-2022-40740", "lastModified": "2024-11-21T07:21:57.663", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "twcert@cert.org.tw", "type": "Secondary"}]}, "published": "2023-01-03T03:15:09.960", "references": [{"source": "twcert@cert.org.tw", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://www.twcert.org.tw/tw/cp-132-6831-19121-1.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://www.twcert.org.tw/tw/cp-132-6831-19121-1.html"}], "sourceIdentifier": "twcert@cert.org.tw", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "twcert@cert.org.tw", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}