Command injection

Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the static ip settings function via the wanipstat, wanmaskstat, wangwstat, and wandns1stat parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2022-27002

CVE-2022-27002 affects Arris TR3300 v1.0.13 and describes a command injection vulnerability in the ddns function, exploitable via ddns_name, ddns_pwd, h_ddns, and ddns_host parameters. The underlying issue enables arbitrary command execution and is rated with high severity (NVD CVSS v3.1: 9.8, NE...

CVE-2022-27002

Arris TR3300 v1.0.13 were discovered to contain a command injection vulnerability in the ddns function via the ddnsname, ddnspwd, hddns、ddnshost parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2022-27001

CVE-2022-27001 affects Arris TR3300 v1.0.13 and is caused by a command injection vulnerability in the DHCP hostname parameter, allowing arbitrary command execution via a crafted request. The issue is documented across multiple sources (ARRIS/TR3300, Red Hat advisory, CNVD/CNVD-like records) and i...

CVE-2022-27001

Arris TR3300 v1.0.13 were discovered to contain a command injection vulnerability in the dhcp function via the hostname parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2022-27000

Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the time and time zone function via the hprimaryntpserver, hbackupntpserver, and htimezone parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2022-27000

Arris TR3300 v1.0.13 is affected by a command-injection vulnerability in the time and time zone function, exploitable via h_primary_ntp_server, h_backup_ntp_server, and h_time_zone parameters. The issue allows arbitrary command execution and is described across multiple sources (NVD/Red Hat/CNVD/...

CVE-2022-26999

Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the static ip settings function via the wanipstat, wanmaskstat, wangwstat, and wandns1stat parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2022-26999

Arris TR3300 v1.0.13 is affected by a command-injection vulnerability in the static IP settings function, exploitable via wan_ip_stat, wan_mask_stat, wan_gw_stat, and wan_dns1_stat parameters. Successful exploitation allows arbitrary commands to be executed; CVSS v3.1 base score 9.8 (CRITICAL). M...

CVE-2022-26998

This CVE affects Arris TR3300 v1.0.13, with a command injection vulnerability in the wps setting function through the wps_enrolee_pin parameter. The root cause is improper handling/filtering of crafted input in that parameter, enabling an attacker to execute arbitrary commands. The relevant advis...

CVE-2022-26998

Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the wps setting function via the wpsenroleepin parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2022-26996

Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the pppoe function via the pppoeusername, pppoepasswd, and pppoeservicename parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2022-26997

CVE-2022-26997 affects Arris TR3300 v1.0.13. A command injection flaw exists in the upnp function via the upnp_ttl parameter, allowing arbitrary command execution through a crafted request. Documented impact is high (remote attacker, network access). No explicit remediation/version patch is provi...

CVE-2022-26996

CVE-2022-26996 affects Arris TR3300 v1.0.13, introducing a command-injection flaw in the pppoe function via crafted pppoe_username, pppoe_passwd, and pppoe_servicename parameters. Exploitation allows arbitrary command execution without user interaction. Public sources in the provided set (NVD/Red...

CVE-2022-26997

Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the upnp function via the upnpttl parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2022-26995

Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the pptp wanpptp.html function via the pptpfixip, pptpfixmask, pptpfixgw, and wandns1stat parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2022-26995

Arris TR3300 v1.0.13 is affected by a command injection vulnerability in the pptp function (pptp_fix_ip, pptp_fix_mask, pptp_fix_gw, wan_dns1_stat) exposed via the pptp/wang_pptp.html endpoints. The issue arises from insufficient input validation, enabling an attacker to craft a request that exec...

PT-2022-18177 · Arris · Arris Tr3300

Name of the Vulnerable Software and Affected Versions: Arris TR3300 version 1.0.13 Description: The issue is related to a command injection vulnerability in the time and time zone function. This vulnerability is exploited via the h primary ntp server, h backup ntp server, and h time zone...

ARRIS TR3300 命令注入漏洞

ARRIS TR3300 is an 802.11ac Wi-Fi router from ARRIS U.S.A. A command injection vulnerability exists in ARRIS TR3300, which stems from the failure of the htimezone parameter in the time zone function to properly filter the construct command special characters, commands, etc. The vulnerability can ...

ARRIS TR3300 命令注入漏洞

ARRIS TR3300 is an 802.11ac Wi-Fi router from ARRIS U.S.A. A command injection vulnerability exists in ARRIS TR3300 v1.0.13, which stems from the failure of the wpsenroleepin parameter in the wps function to properly filter the construct command special characters, commands, etc. An attacker coul...