CVE-2022-38066

2023-01-2621:24:36

CWE-78

talos

www.cve.org

command injection

snmp functionality

siretta quartz-gold

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

49.4%

JSON

An OS command injection vulnerability exists in the httpd SNMP functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted HTTP response can lead to arbitrary command execution. An attacker can send a network request to trigger this vulnerability.

CNA Affected

[
  {
    "vendor": "Siretta",
    "product": "QUARTZ-GOLD",
    "versions": [
      {
        "version": "G5.0.1.5-210720-141020",
        "status": "affected"
      }
    ]
  }
]