CVE-2022-40282

2022-11-2500:00:00

mitre

www.cve.org

web server

hirschmann bat-c2

authenticated

command injection

vendor's id

bsecv-2022-21

9.2 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

61.2%

JSON

The web server of Hirschmann BAT-C2 before 09.13.01.00R04 allows authenticated command injection. This allows an authenticated attacker to pass commands to the shell of the system because the dir parameter of the FsCreateDir Ajax function is not sufficiently sanitized. The vendor’s ID is BSECV-2022-21.