CVE-2022-27002

CRITICAL EXPLOITED

Arris TR3300 v1.0.13 - OS Command Injection via DDNS Parameters

Title source: llm

Exploitation Summary

CVE-2022-27002 has been observed exploited in the wild (reported by VulnCheck KEV).

Description

Arris TR3300 v1.0.13 were discovered to contain a command injection vulnerability in the ddns function via the ddns_name, ddns_pwd, h_ddns、ddns_host parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request.

References (1)

Core 1

Core References

Broken Link, Exploit, Third Party Advisory x_refsource_misc

https://github.com/wudipjq/my_vuln/blob/main/ARRIS/vuln_10/10.md

Scores

CVSS v3 9.8

EPSS 0.0612

EPSS Percentile 92.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

VulnCheck KEV 2023-06-22

CWE

CWE-77

Status published

Products (1)

commscope/arris_tr3300_firmware 1.0.13

Published Mar 15, 2022

Tracked Since Feb 18, 2026