CVE-2022-27224
🟡 Monitoruj
Wstrzyknięcie poleceń w Galleon NTS-6002-GPS umożliwia atakującemu uzyskanie uprawnień roota.
CVSS
7.2
EPSS
19.7%
Exploit
poc
Vendor
galsys
Opis źródłowy (NVD)
An issue was discovered in Galleon NTS-6002-GPS 4.14.103-Galleon-NTS-6002.V12 4. An authenticated attacker can perform command injection as root via shell metacharacters within the Network Tools section of the web-management interface. All three networking tools are affected (Ping, Traceroute, and DNS Lookup) and their respective input fields (ping_address, trace_address, nslookup_address).
exploit rce
Brak patcha
Źródła i daty
| Źródło | Wartość |
|---|---|
| NVD – CVSS | 7.2 |
| CISA KEV (aktywnie wykorzystywane) | Nie |
| FIRST EPSS (prawdopodobieństwo exploita) | 19.7% |
| Opublikowano (NVD) | 2022-05-09 15:15:07 UTC |
| Ostatnia modyfikacja (NVD) | 2024-11-21 06:55:26 UTC |
Referencje
- https://gist.github.com/somerandomdudeonetheinternet/2caeb201e249160fa82204ef640c8cdf (cve@mitre.org) [Third Party Advisory]
- https://www.galsys.co.uk/support/software-download.html (cve@mitre.org) [Product, Vendor Advisory]
- https://www.pentestpartners.com/security-blog/galleon-nts-6002-gps-command-injection-vulnerability-cve-2022-27224/ (cve@mitre.org) [Exploit, Third Party Advisory]