CVE-2022-40969

CVE-2022-40969 (Siretta QUARTZ-GOLD) is a OS command injection vulnerability in the httpd delfile.cgi file-management endpoint. Talos reports that the delfile.cgi handler accepts a parameter named _filename, appends it to a base folder path, and then executes rm -rf / via system(), with the filen...

Siretta QUARTZ-GOLD httpd delfile.cgi OS command injection vulnerability

Talos Vulnerability Report TALOS-2022-1607 Siretta QUARTZ-GOLD httpd delfile.cgi OS command injection vulnerability January 26, 2023 CVE Number CVE-2022-40969 SUMMARY An os command injection vulnerability exists in the httpd delfile.cgi functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020....