CVE-2022-4982

CVE-2022-4982 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 1 public exploit from researchers including Valtteri Lehtinen.

AI-analyzed exploit summary This exploit demonstrates a Local File Inclusion (LFI) vulnerability in Dbltek GoIP devices, allowing unauthorized access to sensitive files such as /etc/passwd and configuration files containing credentials. The PoC provides specific URLs to exploit the vulnerability without requiring authentication.

DBLTek GoIP-1 firmware versions up to and including GHSFVT-1.1-67-5 contain a local file inclusion vulnerability. The device's web server exposes handlers (`frame.html` and `frame.A100.html`) that accept a path parameter (`content` or `sidebar`) which is not properly validated or canonicalized. An attacker can supply directory-traversal sequences to cause the server to read and return arbitrary filesystem files that the webserver user can access. Other GoIP models and firmware versions are likely affected. Exploitation evidence was observed by the Shadowserver Foundation on 2024-03-21 UTC.