CVE-2022-44149
HIGH EXPLOITEDNexxt Amp300 ARN02304U8 RCE via Ping Feature JSON Host Field
Title source: llmExploitation Summary
CVE-2022-44149 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 4 public exploits from researchers including Yerodin Richards, geniuszly, yerodin.
AI-analyzed exploit summary This exploit targets a command injection vulnerability in Nexxt Router Firmware 42.103.1.5095. It authenticates with the router and sends a malicious payload via the `sysTools` endpoint to enable telnetd, allowing remote code execution.
Description
The web service on Nexxt Amp300 ARN02304U8 42.103.1.5095 and 80.103.2.5045 devices allows remote OS command execution by placing &telnetd in the JSON host field to the ping feature of the goform/sysTools component. Authentication is required
Exploits (4)
This exploit targets a command injection vulnerability in Nexxt Router Firmware 42.103.1.5095. It authenticates with the router and sends a malicious payload via the `sysTools` endpoint to enable telnetd, allowing remote code execution.
The repository contains a Python script and README for CVE-2022-44149, but the payload is a placeholder ('example_payload') and lacks actual exploit logic. It demonstrates authentication and payload delivery structure but does not implement the vulnerability.
This PoC exploits an authenticated RCE vulnerability in Nexxt Router Firmware 80.103.2.5045 by sending a malicious payload via the sysTools endpoint to enable telnetd. It requires valid credentials and leverages command injection in the host parameter.
This repository contains a functional Python script that exploits CVE-2022-44149, a vulnerability allowing arbitrary command execution via the router's web interface. The script includes authentication handling, payload delivery, and logging for analysis.
References (5)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H