CVE-2022-32429

CRITICAL NUCLEI

Mega System Technologies MSNSwitch MNT.2408 - Unauthenticated Remote Code Execution via ExportSettings.sh

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2022-32429. PoCs published by Eli Fulkerson. A Nuclei detection template is also available.

AI-analyzed exploit summary This exploit demonstrates unauthenticated configuration dump and authenticated RCE in MSNSwitch Firmware MNT.2408 via command injection in the firmware upgrade mechanism. It leverages a CSRF token and command injection to execute arbitrary commands, sending results to a listener.

Description

An authentication-bypass issue in the component http://MYDEVICEIP/cgi-bin-sdb/ExportSettings.sh of Mega System Technologies Inc MSNSwitch MNT.2408 allows unauthenticated attackers to arbitrarily configure settings within the application, leading to remote code execution.

Exploits (1)

exploitdb WORKING POC

by Eli Fulkerson · pythonremotehardware

https://www.exploit-db.com/exploits/51027

View Code ZIP pw:eip

This exploit demonstrates unauthenticated configuration dump and authenticated RCE in MSNSwitch Firmware MNT.2408 via command injection in the firmware upgrade mechanism. It leverages a CSRF token and command injection to execute arbitrary commands, sending results to a listener.

Classification

Working Poc 95%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: MSNSwitch Firmware MNT.2408

Auth required

Prerequisites: Network access to the target device · Valid credentials for authenticated RCE

MITRE ATT&CK

T1189 - Drive-by Compromise T1059 - Command and Scripting Interpreter

devstral-2 · analyzed Feb 16, 2026 Full analysis →

Nuclei Templates (1)

MSNSwitch Firmware MNT.2408 - Authentication Bypass

CRITICALVERIFIEDby theabhinavgaur

Shodan: http.favicon.hash:-2073748627 || http.favicon.hash:-1721140132

References (2)

Core 2

Core References

Exploit, Third Party Advisory, VDB Entry

http://packetstormsecurity.com/files/169819/MSNSwitch-Firmware-MNT.2408-Remote-Code-Execution.html

Exploit, Third Party Advisory

https://elifulkerson.com/CVE-2022-32429/

Scores

CVSS v3 9.8

EPSS 0.7572

EPSS Percentile 99.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-287

Status published

Products (1)

megatech/msnswitch_firmware mnt.2408

Published Aug 10, 2022

Tracked Since Feb 18, 2026