SB2022101723 - Multiple vulnerabilities in Robustel R1510

Main Vulnerability Database SB2022101723

SB2022101723 - Multiple vulnerabilities in Robustel R1510

Published: October 17, 2022

Security Bulletin ID SB2022101723

CSH Severity

Low

Patch available

NO

Number of vulnerabilities 16

Exploitation vector Remote access

Highest impact Code execution

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 16 vulnerabilities.

1) OS Command Injection (CVE-ID: CVE-2022-33150)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation in the js_package install functionality. A remote administrator can pass specially crafted data to the application and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

2) Input validation error (CVE-ID: CVE-2022-35266)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the web_server hashFirst functionality in the /action/import_firmware/ API. A remote administrator can pass specially crafted input to the application and perform a denial of service (DoS) attack.

3) Input validation error (CVE-ID: CVE-2022-35271)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the web_server hashFirst functionality in the /action/import_cert_file/ API. A remote administrator can pass specially crafted input to the application and perform a denial of service (DoS) attack.

4) Input validation error (CVE-ID: CVE-2022-35263)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the web_server hashFirst functionality in the /action/import_file/ API. A remote administrator can pass specially crafted input to the application and perform a denial of service (DoS) attack.

5) Input validation error (CVE-ID: CVE-2022-35264)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the web_server hashFirst functionality in the /action/import_aaa_cert_file/ API. A remote administrator can pass specially crafted input to the application and perform a denial of service (DoS) attack.

6) Input validation error (CVE-ID: CVE-2022-35262)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the web_server hashFirst functionality in the /action/import_xml_file/ API. A remote administrator can pass specially crafted input to the application and perform a denial of service (DoS) attack.

7) Input validation error (CVE-ID: CVE-2022-35267)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the web_server hashFirst functionality in the /action/import_https_cert_file/ API. A remote administrator can pass specially crafted input to the application and perform a denial of service (DoS) attack.

8) Input validation error (CVE-ID: CVE-2022-35268)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the web_server hashFirst functionality in the /action/import_sdk_file/ API. A remote administrator can pass specially crafted input to the application and perform a denial of service (DoS) attack.

9) Input validation error (CVE-ID: CVE-2022-35261)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the web_server hashFirst functionality in the /action/import_authorized_keys/ API. A remote administrator can pass specially crafted input to the application and perform a denial of service (DoS) attack.

10) Input validation error (CVE-ID: CVE-2022-35265)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the web_server hashFirst functionality in the /action/import_nodejs_app/ API. A remote administrator can pass specially crafted input to the application and perform a denial of service (DoS) attack.

11) Input validation error (CVE-ID: CVE-2022-35270)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the web_server hashFirst functionality in the /action/import_wireguard_cert_file/ API. A remote administrator can pass specially crafted input to the application and perform a denial of service (DoS) attack.

12) Input validation error (CVE-ID: CVE-2022-35269)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the web_server hashFirst functionality in the /action/import_e2c_json_file/ API. A remote administrator can pass specially crafted input to the application and perform a denial of service (DoS) attack.

13) OS Command Injection (CVE-ID: CVE-2022-32765)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation in the sysupgrade command injection functionality. A remote administrator can pass specially crafted data to the application and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

14) Insufficient verification of data authenticity (CVE-ID: CVE-2022-34845)

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to compromise the target system.

The vulnerability exists due to insufficient verification of data authenticity in the sysupgrade functionality. A remote administrator can send a specially crafted packet and cause arbitrary firmware update.

15) Path traversal (CVE-ID: CVE-2022-33897)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences in the web_server /ajax/remove/ functionality. A remote administrator can send a specially crafted HTTP request and delete arbitrary files on the system.

16) OS Command Injection (CVE-ID: CVE-2022-34850)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation in the web_server /action/import_authorized_keys/ functionality. A remote administrator can pass specially crafted data to the application and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References