CVE-2022-32429

CRITICALNuclei

MSNSwitch Firmware MNT.2408 - Remote Code Execution

Title source: exploit-db.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2022-32429 has a selected CVSS score of 9.8 (critical); EIP currently links 1 catalogued exploit and 1 Nuclei template.

Description

An authentication-bypass issue in the component http://MYDEVICEIP/cgi-bin-sdb/ExportSettings.sh of Mega System Technologies Inc MSNSwitch MNT.2408 allows unauthenticated attackers to arbitrarily configure settings within the application, leading to remote code execution.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1
Nuclei templates
1

Proofs of concept

1

Catalogued exploits

ExploitDBMSNSwitch Firmware MNT.2408 - Remote Code ExecutionExploitDB exploitby Eli FulkersonNot analyzed1 file
ExploitDB
PoC details

Nuclei templates

1
ProjectDiscoveryCRITICALMSNSwitch Firmware MNT.2408 - Authentication BypassCVSS 9.8

MSNSwitch Firmware MNT.2408 is susceptible to authentication bypass in the component http://MYDEVICEIP/cgi-bin-sdb/ExportSettings.sh. An attacker can arbitrarily configure settings, leading to possible remote code execution and subsequent unauthorized operations.

Impact

Successful exploitation of this vulnerability allows an attacker to bypass authentication and gain unauthorized access to the affected device.

Remediation

Apply the latest firmware update provided by the vendor to fix the authentication bypass vulnerability.

WeaknessesCWE-287
Authorstheabhinavgaur
Template tagscve2022cveconfigdumppacketstormmsmswitchunauthswitchmegatechvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:o:megatech:msnswitch_firmware:mnt.2408:*:*:*:*:*:*:*
Shodan: http.favicon.hash:-2073748627 || http.favicon.hash:-1721140132
https://packetstormsecurity.com/files/169819/MSNSwitch-Firmware-MNT.2408-Remote-Code-Execution.html https://elifulkerson.com/CVE-2022-32429/ https://nvd.nist.gov/vuln/detail/CVE-2022-32429 http://packetstormsecurity.com/files/169819/MSNSwitch-Firmware-MNT.2408-Remote-Code-Execution.html https://github.com/ARPSyndicate/cvemon

Source: ProjectDiscovery

References

3