exploitDog

CVE-2022-4221

Опубликовано: 01 дек. 2022

Источник: nvd

CVSS3: 9.8

EPSS Средний

Описание

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Asus NAS-M25 allows an unauthenticated attacker to inject arbitrary OS commands via unsanitized cookie values.This issue affects NAS-M25: through 1.0.1.7.

Ссылки

https://onekey.com/blog/security-advisory-asus-m25-nas-vulnerability/
Exploit
Technical Description
Third Party Advisory
https://onekey.com/blog/security-advisory-asus-m25-nas-vulnerability/
Exploit
Technical Description
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:asus:nas-m25_firmware:*:*:*:*:*:*:*:*

Версия до 1.0.1.7 (включая)

cpe:2.3:h:asus:nas-m25:-:*:*:*:*:*:*:*

EPSS

Процентиль: 98%

0.55206

Средний

9.8 Critical

CVSS3

Дефекты

CWE-78

CWE-78

Связанные уязвимости

GHSA-pqv9-66jx-6q5v

CVSS3: 9.8

github

около 3 лет назад

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Asus NAS-M25 allows an unauthenticated attacker to inject arbitrary OS commands via unsanitized cookie values.This issue affects NAS-M25: through 1.0.1.7.

EPSS

Процентиль: 98%

0.55206

Средний

9.8 Critical

CVSS3

Дефекты

CWE-78

CWE-78