dbltek.comproduct
http://www.dbltek.com/ CVE-2022-4982
HIGH
DBLTek GoIP-1 vGHSFVT-1.1-67-5 Unauthenticated LFI
Record summary
CVE-2022-4982 has a selected CVSS score of 8.7 (high); EIP currently links 1 catalogued exploit.
Description
DBLTek GoIP-1 firmware versions up to and including GHSFVT-1.1-67-5 contain a local file inclusion vulnerability. The device's web server exposes handlers (`frame.html` and `frame.A100.html`) that accept a path parameter (`content` or `sidebar`) which is not properly validated or canonicalized. An attacker can supply directory-traversal sequences to cause the server to read and return arbitrary filesystem files that the webserver user can access. Other GoIP models and firmware versions are likely affected. Exploitation evidence was observed by the Shadowserver Foundation on 2024-03-21 UTC.
Description source: CVE List
Exploitation context
Known exploitation
- VulnCheck KEV
- Listed · Nov 12, 2025 · VulnCheck
- Reported exploitation
- Observed · VulnCheck
Available material
- Catalogued exploits
- 1
CISA SSVC decision
ExploitationPoC
AutomatableYes
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Nov 13, 2025 · Source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
Default status: unknown | CVE List | Through GHSFVT-1.1-67-5 | affected |
| VulnCheck | Version data not supplied | ||
Proofs of concept
1Catalogued exploits
ExploitDBDbltek GoIP - Local File InclusionExploitDB exploitby Valtteri LehtinenNot analyzed1 file
References
5nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2022-4982 shufflingbytes.comTechnical descriptionexploit
https://shufflingbytes.com/posts/hacking-goip-gsm-gateway exploit-db.comexploit
https://www.exploit-db.com/exploits/50775 vulncheck.comThird-party advisory
https://www.vulncheck.com/advisories/dbltek-goip-unauthenticated-lfi