CVE-2022-27226

{"id": "CVE-2022-27226", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2022-03-19T04:15:08.793", "references": [{"url": "http://packetstormsecurity.com/files/166396/iRZ-Mobile-Router-Cross-Site-Request-Forgery-Remote-Code-Execution.html", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "https://en.irz.ru", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://github.com/SakuraSamuraii/ez-iRZ", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://johnjhacking.com/blog/cve-2022-27226/", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://packetstormsecurity.com/files/166396/iRZ-Mobile-Router-Cross-Site-Request-Forgery-Remote-Code-Execution.html", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://en.irz.ru", "tags": ["Product"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/SakuraSamuraii/ez-iRZ", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://johnjhacking.com/blog/cve-2022-27226/", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "A CSRF issue in /api/crontab on iRZ Mobile Routers through 2022-03-16 allows a threat actor to create a crontab entry in the router administration panel. The cronjob will consequently execute the entry on the threat actor's defined interval, leading to remote code execution, allowing the threat actor to gain filesystem access. In addition, if the router's default credentials aren't rotated or a threat actor discovers valid credentials, remote code execution can be achieved without user interaction."}, {"lang": "es", "value": "Un problema de tipo CSRF en /api/crontab en los Routers M\u00f3viles iRZ versiones hasta 16-03-2022, permite a un actor de la amenaza crear una entrada crontab en el panel de administraci\u00f3n del router. El cronjob ejecutar\u00e1 consecuentemente la entrada en el intervalo definido por el actor de la amenaza, conllevando a una ejecuci\u00f3n de c\u00f3digo remota, permitiendo al actor de la amenaza conseguir acceso al sistema de archivos. Adem\u00e1s, si las credenciales por defecto del router no son rotadas o un actor de la amenaza detecta credenciales v\u00e1lidas, puede lograrse una ejecuci\u00f3n de c\u00f3digo remota sin la interacci\u00f3n del usuario"}], "lastModified": "2024-11-21T06:55:26.920", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:irz:ru21_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9D1E8C7C-C5FF-48C5-9FF4-48C07B691C24", "versionEndIncluding": "2022-03-16"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:irz:ru21:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "06E6B264-05A7-4C72-83D7-3EAEBF340378"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:irz:ru21w_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "11F65708-E64B-4B45-BA19-05FCA6726CC6", "versionEndIncluding": "2022-03-16"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:irz:ru21w:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "97158654-DA22-496A-899C-6CE11A518EE9"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:irz:rl21_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A21E7D88-10A8-46E8-9609-AF19C507E6D3", "versionEndIncluding": "2022-03-16"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:irz:rl21:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "2561102E-68F5-4A6F-93CD-189D09916EE5"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:irz:ru41_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8E640881-33DA-47EC-B864-1455D87EA194", "versionEndIncluding": "2022-03-16"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:irz:ru41:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "3F1B909F-ED44-4A9A-804F-0FCEC6D1635C"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:irz:rl01_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CE1A77D2-0CAB-4BED-B452-3369830953EF", "versionEndIncluding": "2022-03-16"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:irz:rl01:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "55254704-61C2-4A03-BC0B-A9DE160DD0D9"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}