Lucene search

INCIBEVULNRICHMENT:CVE-2022-47893

HistoryOct 03, 2023 - 11:28 a.m.

CVE-2022-47893 NetMan 204 Remote Code Execution

2023-10-0311:28:22

CWE-434

INCIBE

github.com

cve-2022-47893

netman 204

remote code execution

firmware upload

arbitrary code

root access

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

AI Score

8.5

Confidence

Low

SSVC

Exploitation

none

Automatable

yes

Technical Impact

total

JSON

There is a remote code execution vulnerability that affects all versions of NetMan 204. A remote attacker could upload a firmware file containing a webshell, that could allow him to execute arbitrary code as root.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:o:riello-ups:netman_204_firmware:*:*:*:*:*:*:*:*"
    ],
    "vendor": "riello-ups",
    "product": "netman_204_firmware",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "*",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]

References

www.incibe.es/incibe-cert/alerta-temprana/avisos-sci/multiples-vulnerabilidades-netman-204-riello-ups

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

AI Score

8.5

Confidence

Low

SSVC

Exploitation

none

Automatable

yes

Technical Impact

total

JSON

Related for VULNRICHMENT:CVE-2022-47893