CVE-2022-31126

🗓️ 06 Jul 2022 17:30:13Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 5 Media mentions👁 140 Views🌐 WEB

Roxy-wi allows remote code execution via HTTP request in /app/options.py (CVE-2022-31126)

Reporter	Title	Published	Views	Family All 17
zdt	Roxy WI v6.1.0.0 - Unauthenticated Remote Code Execution Vulnerability	3 Apr 202300:00	–	zdt
BDU FSTEC	Roxy-wi SSH Command Code Execution	11 Jul 202200:00	–	bdu_fstec
Circl	CVE-2022-31126	6 Jul 202222:14	–	circl
CNNVD	Roxy-WI 注入漏洞	6 Jul 202200:00	–	cnnvd
Cvelist	CVE-2022-31126 Unauthenticated Remote Code Execution in Roxy-wi	6 Jul 202217:30	–	cvelist
Exploit DB	Roxy WI v6.1.0.0 - Unauthenticated Remote Code Execution (RCE)	3 Apr 202300:00	–	exploitdb
KittySploit	Roxy-WI - Remote Code Execution Detection	28 Jul 202611:27	–	kittysploit
Mend	CVE-2022-31126	6 Jul 202217:30	–	mend
Nuclei	Roxy-WI - Remote Code Execution	15 Oct 202602:05	–	nuclei
NVD	CVE-2022-31126	6 Jul 202218:15	–	nvd

NVD

Vulners

Node

roxy-wi roxy-wiRange<6.1.1.0

[
  {
    "product": "roxy-wi",
    "vendor": "hap-wi",
    "versions": [
      {
        "status": "affected",
        "version": "< 6.1.1.0"
      }
    ]
  }
]

Source	Link
github	www.github.com/hap-wi/roxy-wi/security/advisories/GHSA-mh86-878h-43c9

Parameter	Position	Path	Description	CWE
getcert	request body	/app/options.py	Unauthenticated remote code execution via POST to /app/options.py with crafted parameters (evidence in PoC shows getcert parameter manipulated to execute commands).	CWE-74