github - ghsa-g37x-jpmr-w7p9

GHSA-G37X-JPMR-W7P9

Vulnerability from github – Published: 2023-07-06 19:24 – Updated: 2024-04-04 05:30

Details

An attacker with physical access to Moxa's bootloader versions of UC-8580 Series V1.1, UC-8540 Series V1.0 to V1.2, UC-8410A Series V2.2, UC-8200 Series V1.0 to V2.4, UC-8100A-ME-T Series V1.0 to V1.1, UC-8100 Series V1.2 to V1.3, UC-5100 Series V1.2, UC-3100 Series V1.2 to V2.0, UC-2100 Series V1.3 to V1.5, and UC-2100-W Series V1.3 to V1.5 can initiate a restart of the device and gain access to its BIOS. Command line options can then be altered, allowing the attacker to access the terminal. From the terminal, the attacker can modify the device’s authentication files to create a new user and gain full access to the system.

Severity ?

7.6 (High)


                  
                    CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2022-3086"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1263",
      "CWE-77"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-12-02T20:15:00Z",
    "severity": "HIGH"
  },
  "details": "An attacker with physical access to Moxa\u0027s bootloader versions of UC-8580 Series V1.1, UC-8540 Series V1.0 to V1.2, UC-8410A Series V2.2, UC-8200 Series V1.0 to V2.4, UC-8100A-ME-T Series V1.0 to V1.1, UC-8100 Series V1.2 to V1.3, UC-5100 Series V1.2, UC-3100 Series V1.2 to V2.0, UC-2100 Series V1.3 to V1.5, and UC-2100-W Series V1.3 to V1.5 can initiate a restart of the device and gain access to its BIOS. Command line options can then be altered, allowing the attacker to access the terminal. From the terminal, the attacker can modify the device\u2019s authentication files to create a new user and gain full access to the system.",
  "id": "GHSA-g37x-jpmr-w7p9",
  "modified": "2024-04-04T05:30:41Z",
  "published": "2023-07-06T19:24:05Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3086"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-321-02"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-333-04"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2022-3086 (GCVE-0-2022-3086)

Vulnerability from cvelistv5 – Published: 2022-11-29 00:00 – Updated: 2025-04-16 17:42

Title

Cradlepoint IBR600 Command Injection

Summary

Cradlepoint IBR600 NCOS versions 6.5.0.160bc2e and prior are vulnerable to shell escape, which enables local attackers with non-superuser credentials to gain full, unrestrictive shell access which may allow an attacker to execute arbitrary code.

Severity ?

7.1 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

CWE

CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')

Assigner

icscert

References

URL

Tags

https://www.cisa.gov/uscert/ics/advisories/icsa-2…

Impacted products

	Vendor	Product	Version
	Cradlepoint	IBR600	Affected: 0 , ≤ 6.5.0.160bc2e (custom)

Credits

Uri Katz of Claroty Research reported these vulnerabilities to CISA.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T01:00:10.222Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-321-02"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-3086",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-16T17:25:49.176863Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-16T17:42:11.399Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "NetCloud OS (NCOS)"
          ],
          "product": "IBR600 ",
          "vendor": "Cradlepoint",
          "versions": [
            {
              "lessThanOrEqual": "6.5.0.160bc2e",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Uri Katz of Claroty Research reported these vulnerabilities to CISA."
        }
      ],
      "datePublic": "2022-11-17T23:32:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\nCradlepoint IBR600 NCOS versions 6.5.0.160bc2e and prior are vulnerable \nto shell escape, which enables local attackers with non-superuser \ncredentials to gain full, unrestrictive shell access which may allow an \nattacker to execute arbitrary code.\n\n"
            }
          ],
          "value": "Cradlepoint IBR600 NCOS versions 6.5.0.160bc2e and prior are vulnerable \nto shell escape, which enables local attackers with non-superuser \ncredentials to gain full, unrestrictive shell access which may allow an \nattacker to execute arbitrary code.\n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-77",
              "description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-12-07T23:34:24.434Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-321-02"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\u003cp\u003eCradlepoint recommends users to update to at least version: \u003c/p\u003e\n\n\u003cul\u003e\u003cli\u003eNCOS v7.22.70\u003c/li\u003e\n\u003c/ul\u003e\u003cp\u003eNCOS release 7.1.0 and greater are no longer available for \nmanual or offline download and are performed via the NetCloud Manager, \nwhich requires a subscription. For more information and NCOS upgrade \nbest practices visit \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://cradlepoint.com/products/netcloud-service/\"\u003eCradlepoint Netcloud Service\u003c/a\u003e\u003cspan style=\"background-color: var(--wht);\"\u003e.\u003c/span\u003e\u003c/p\u003e\n\n\u003cp\u003eFor more information about the latest update, see the \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://d2c9o94y5j661e.cloudfront.net/FW-ReleaseNotesNCOS7.22.70-050722.pdf\"\u003eCradlepoint Release Notes\u003c/a\u003e\u003cspan style=\"background-color: var(--wht);\"\u003e.\u003c/span\u003e\u003c/p\u003e"
            }
          ],
          "value": "Cradlepoint recommends users to update to at least version: \n\n\n\n  *  NCOS v7.22.70\n\n\n\nNCOS release 7.1.0 and greater are no longer available for \nmanual or offline download and are performed via the NetCloud Manager, \nwhich requires a subscription. For more information and NCOS upgrade \nbest practices visit  Cradlepoint Netcloud Service https://cradlepoint.com/products/netcloud-service/ .\n\n\n\nFor more information about the latest update, see the  Cradlepoint Release Notes https://d2c9o94y5j661e.cloudfront.net/FW-ReleaseNotesNCOS7.22.70-050722.pdf .\n\n"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Cradlepoint IBR600 Command Injection",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2022-3086",
    "datePublished": "2022-11-29T00:00:00.000Z",
    "dateReserved": "2022-09-01T00:00:00.000Z",
    "dateUpdated": "2025-04-16T17:42:11.399Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-G37X-JPMR-W7P9

CVE-2022-3086 (GCVE-0-2022-3086)

Tags

Sightings

Nomenclature