CVE-2022-28127CWE-20

A data removal vulnerability exists in the web_server /action/remove/ API functionality of Robustel R1510 3.3.0

High · published June 30, 2022

CVSS v3.0
8.7
EPSS
38%
Percentile
98.6
In the wild
Unconfirmed
What it is

⚡ A well-crafted network request is all it takes to delete any file on your Robustel R1510! 🚨 Think of it like a waiter at a restaurant who misplaces an order and accidentally clears an entire table of dishes instead of just one — this vulnerability lets attackers remove files without a second thought! An attacker could exploit this to delete crucial files, leading to data loss and potentially crippling your operations. Imagine losing important logs or configuration files right when you need them the most—absolutely devastating!

Put simply

Think of it like a waiter at a restaurant who misplaces an order and accidentally clears an entire table of dishes instead of just one — this vulnerability lets attackers remove files without a second thought! This vulnerability in the /action/remove/ API functionality allows arbitrary file deletion through specially crafted network requests, meaning an attacker can erase files by simply sending the right sequence of commands.

What to do

An attacker could exploit this to delete crucial files, leading to data loss and potentially crippling your operations. Imagine losing important logs or configuration files right when you need them the most—absolutely devastating! To protect yourself, upgrade your Robustel R1510 to version 3.3.1 immediately. Additionally, restrict API access to trusted sources to minimize the risk of exploitation. Keep monitoring your logs for any suspicious activity! You’ve got this! With these steps, you’ll put an end to this vulnerability and keep your files safe. 🛡️

The record
Technical detail
CVSS v3.0
8.7 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.37934 · 98.6th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2022-06-30T19:05Z
EPSS history
Timeline
  • 30 JUN 19:05Z
    A data removal vulnerability exists in the web_server /action/remove/ API functionality of Robustel R1510 3.3.0
    cvelistv5