CVE-2022-36553

CRITICALNuclei

hytec hwl-2511-ss_firmware Improper Neutralization of Special Elements used in a Command ('Command Injection')

Title source: VulnCheck
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2022-36553 has a selected CVSS score of 9.8 (critical); EIP currently links 1 repository PoC and 1 Nuclei template.

Description

Hytec Inter HWL-2511-SS v1.05 and below was discovered to contain a command injection vulnerability via the component /www/cgi-bin/popen.cgi.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Jan 21, 2024 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Repository PoCs
1
Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

hwl-2511-ss_firmware

Browse hytec / hwl-2511-ss_firmware
VulnCheckVersion data not supplied

Proofs of concept

1

Repository PoCs

GitHub0xNslabs/CVE-2022-36553-PoCRepository PoCby 0xNslabs6Not analyzed2 files

7.0 KiB

GitHub
PoC details

Nuclei templates

1
ProjectDiscoveryCRITICALHytec Inter HWL-2511-SS - Remote Command ExecutionCVSS 9.8

Hytec Inter HWL-2511-SS v1.05 and below was discovered to contain a command injection vulnerability via the component /www/cgi-bin/popen.cgi.

Impact

Unauthenticated attackers can execute arbitrary commands on the Hytec Inter HWL-2511-SS cellular router through command injection in the popen.cgi endpoint, potentially gaining complete control over the device and connected network infrastructure.

Remediation

Update Hytec Inter HWL-2511-SS firmware to a version later than 1.05 that properly sanitizes command parameters in popen.cgi.

WeaknessesCWE-77
AuthorsHuTa0
Template tagscve2022cvehytecrcevkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:o:hytec:hwl-2511-ss_firmware:*:*:*:*:*:*:*:*
FOFA: title="index" && header="lighttpd/1.4.30"
https://nvd.nist.gov/vuln/detail/CVE-2022-36553 https://github.com/zan8in/afrog/blob/main/v2/pocs/afrog-pocs/vulnerability/cellular-router-rce.yaml https://gist.github.com/Nwqda/b27418ab801eb0b9cdbe8d042cb0249b https://hytec.co.jp/eng/products/our-brand/hwl-2511-ss.html https://hytec.co.jp/eng/wordpress/wp-content/uploads/2019/09/hwl-2511-ss-ds.3.0.pdf

Source: ProjectDiscovery

References

4