CVE-2022-42490

2023-01-2621:24:34

CWE-78

talos

www.cve.org

command injection

siretta quartz-gold g5.0.1.5-210720-141020

network request

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

0.002

Percentile

62.3%

JSON

Several OS command injection vulnerabilities exist in the m2m binary of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted network request can lead to arbitrary command execution. An attacker can send a network request to trigger these vulnerabilities.This command injection is reachable through the m2m’s DOWNLOAD_CFG_FILE command

CNA Affected

[
  {
    "vendor": "Siretta",
    "product": "QUARTZ-GOLD",
    "versions": [
      {
        "version": "G5.0.1.5-210720-141020",
        "status": "affected"
      }
    ]
  }
]