CVE-2022-31749
MEDIUMWatchGuard Fireware OS <12.8.1-12.5.10 - Command Injection
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2022-31749. PoCs published by jbaines-r7, iveresk.
AI-analyzed exploit summary This exploit leverages a parameter injection vulnerability in WatchGuard's SSH interface to exfiltrate the `configd-hash.xml` file, which contains unsalted MD4 password hashes, to an attacker-controlled FTP server. It uses the built-in low-privileged `status` user for authentication.
Description
An argument injection vulnerability in the diagnose and import pac commands in WatchGuard Fireware OS before 12.8.1, 12.1.4, and 12.5.10 allows an authenticated remote attacker with unprivileged credentials to upload or read files to limited, arbitrary locations on WatchGuard Firebox and XTM appliances
Exploits (2)
This exploit leverages a parameter injection vulnerability in WatchGuard's SSH interface to exfiltrate the `configd-hash.xml` file, which contains unsalted MD4 password hashes, to an attacker-controlled FTP server. It uses the built-in low-privileged `status` user for authentication.
This PoC exploits a parameter injection vulnerability in WatchGuard's SSH interface (CVE-2022-31749) to exfiltrate the `configd-hash.xml` file, which contains unsalted MD4 password hashes. It uses the low-privileged `status` user with a default password of `readonly` to perform the attack via SCP.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N