Sign-up

ID

VAR-202210-1763


CVE

CVE-2022-42433


TITLE

TP-LINK Technologies  of  tl-wr841  in the firmware  OS  Command injection vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2022-021749

DESCRIPTION

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link TL-WR841N TL-WR841N(US)_V14_220121 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the ated_tp service. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-17356. TP-LINK Technologies of tl-wr841 The firmware has OS A command injection vulnerability exists.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

Trust: 2.34

sources: NVD: CVE-2022-42433 // JVNDB: JVNDB-2022-021749 // ZDI: ZDI-22-1466 // VULMON: CVE-2022-42433

AFFECTED PRODUCTS

vendor:tp linkmodel:tl-wr841scope:ltversion:220914

Trust: 1.0

vendor:tp linkmodel:tl-wr841scope:eqversion:tl-wr841 firmware 220914

Trust: 0.8

vendor:tp linkmodel:tl-wr841scope:eqversion: -

Trust: 0.8

vendor:tp linkmodel:tl-wr841scope: - version: -

Trust: 0.8

vendor:tp linkmodel:tl-wr841nscope: - version: -

Trust: 0.7

sources: ZDI: ZDI-22-1466 // JVNDB: JVNDB-2022-021749 // NVD: CVE-2022-42433

CVSS

SEVERITY

CVSSV2

CVSSV3

zdi-disclosures@trendmicro.com: CVE-2022-42433
value: MEDIUM

Trust: 1.0

nvd@nist.gov: CVE-2022-42433
value: HIGH

Trust: 1.0

NVD: CVE-2022-42433
value: HIGH

Trust: 0.8

ZDI: CVE-2022-42433
value: MEDIUM

Trust: 0.7

CNNVD: CNNVD-202303-2549
value: HIGH

Trust: 0.6

zdi-disclosures@trendmicro.com: CVE-2022-42433
baseSeverity: MEDIUM
baseScore: 6.4
vectorString: CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: HIGH
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 0.5
impactScore: 5.9
version: 3.0

Trust: 1.0

nvd@nist.gov: CVE-2022-42433
baseSeverity: HIGH
baseScore: 8.0
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.1
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2022-42433
baseSeverity: HIGH
baseScore: 8.0
vectorString: CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

ZDI: CVE-2022-42433
baseSeverity: MEDIUM
baseScore: 6.4
vectorString: AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: HIGH
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 0.5
impactScore: 5.9
version: 3.0

Trust: 0.7

sources: ZDI: ZDI-22-1466 // JVNDB: JVNDB-2022-021749 // CNNVD: CNNVD-202303-2549 // NVD: CVE-2022-42433 // NVD: CVE-2022-42433

PROBLEMTYPE DATA

problemtype:CWE-78

Trust: 1.0

problemtype:OS Command injection (CWE-78) [ others ]

Trust: 0.8

sources: JVNDB: JVNDB-2022-021749 // NVD: CVE-2022-42433

THREAT TYPE

remote or local

Trust: 0.6

sources: CNNVD: CNNVD-202303-2549

TYPE

operating system commend injection

Trust: 0.6

sources: CNNVD: CNNVD-202303-2549

EXTERNAL IDS

db:NVDid:CVE-2022-42433

Trust: 4.0

db:ZDIid:ZDI-22-1466

Trust: 3.2

db:JVNDBid:JVNDB-2022-021749

Trust: 0.8

db:ZDI_CANid:ZDI-CAN-17356

Trust: 0.7

db:CNNVDid:CNNVD-202303-2549

Trust: 0.6

db:VULMONid:CVE-2022-42433

Trust: 0.1

sources: ZDI: ZDI-22-1466 // VULMON: CVE-2022-42433 // JVNDB: JVNDB-2022-021749 // CNNVD: CNNVD-202303-2549 // NVD: CVE-2022-42433

REFERENCES

url:https://www.zerodayinitiative.com/advisories/zdi-22-1466/

Trust: 2.5

url:https://nvd.nist.gov/vuln/detail/cve-2022-42433

Trust: 0.8

url:https://cxsecurity.com/cveshow/cve-2022-42433/

Trust: 0.6

url:https://cwe.mitre.org/data/definitions/78.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

sources: VULMON: CVE-2022-42433 // JVNDB: JVNDB-2022-021749 // CNNVD: CNNVD-202303-2549 // NVD: CVE-2022-42433

CREDITS

Cyrille Chatras

Trust: 0.7

sources: ZDI: ZDI-22-1466

SOURCES

db:ZDIid:ZDI-22-1466
db:VULMONid:CVE-2022-42433
db:JVNDBid:JVNDB-2022-021749
db:CNNVDid:CNNVD-202303-2549
db:NVDid:CVE-2022-42433

LAST UPDATE DATE

2024-08-14T15:11:13.469000+00:00


SOURCES UPDATE DATE

db:ZDIid:ZDI-22-1466date:2022-10-25T00:00:00
db:VULMONid:CVE-2022-42433date:2023-03-30T00:00:00
db:JVNDBid:JVNDB-2022-021749date:2023-11-14T03:06:00
db:CNNVDid:CNNVD-202303-2549date:2023-04-06T00:00:00
db:NVDid:CVE-2022-42433date:2023-04-05T16:45:06.287

SOURCES RELEASE DATE

db:ZDIid:ZDI-22-1466date:2022-10-25T00:00:00
db:VULMONid:CVE-2022-42433date:2023-03-29T00:00:00
db:JVNDBid:JVNDB-2022-021749date:2023-11-14T00:00:00
db:CNNVDid:CNNVD-202303-2549date:2023-03-29T00:00:00
db:NVDid:CVE-2022-42433date:2023-03-29T19:15:17.983