CVE-2022-44255
published 2022-11-23CVE-2022-44255: TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a pre-authentication buffer overflow in the main function via long post data.
PriorityP354critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
2.17%
80.2th percentile
TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a pre-authentication buffer overflow in the main function via long post data.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| motioneye_project | motioneye | 0 – 0.42.1 | — |
| totolink | lr350_firmware | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-74cw-qx2v-fgx5: TOTOLINK LR350 V9
ghsa_unreviewed·2022-11-23
CVE-2022-44255 [CRITICAL] CWE-787 GHSA-74cw-qx2v-fgx5: TOTOLINK LR350 V9
TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a pre-authentication buffer overflow in the main function via long post data.
GHSA
Unrestricted Upload of File with Dangerous Type in motionEye
ghsa·2022-02-01
CVE-2021-44255 [HIGH] CWE-434 Unrestricted Upload of File with Dangerous Type in motionEye
Unrestricted Upload of File with Dangerous Type in motionEye
motionEye <= 0.42.1 and motioneEyeOS <= 20200606 allow a remote attacker to upload a configuration backup file containing a malicious python pickle file. This is possible when an installation is accessible over the Internet and uses no or poor authentication credentials.
The GitHub repositories for motionEye and motionEyeOS are no longer being actively maintained as of January 2022, so release of a patched version is unlikely. Keeping a motionEye or motionEyeOS installation off of the Internet and/or using strong credentials provide protection against this issue.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-11-23
Published