CVE-2022-36323CWE-74

Affected devices do not properly sanitize an input field

Critical · published August 10, 2022

CVSS v3.1
9.1
EPSS
2%
Percentile
78.7
In the wild
Unconfirmed
What it is

🚨 An authenticated administrator can inject code straight into the system — that’s like a chef who can add ingredients without any checks at the restaurant! 🔥 Think of it as a restaurant where the head chef can create any dish they want but lacks a quality control process. If the chef starts throwing in strange ingredients, you might end up with a dish that could ruin the entire menu! An attacker wielding administrative privileges could exploit this vulnerability to execute arbitrary code or even spawn a root shell. This means they could take complete control over the system, potentially accessing sensitive data, altering configurations, or wreaking absolute havoc!

Put simply

Think of it as a restaurant where the head chef can create any dish they want but lacks a quality control process. If the chef starts throwing in strange ingredients, you might end up with a dish that could ruin the entire menu! This vulnerability arises because affected devices fail to properly sanitize an input field, allowing an attacker to inject malicious code once they have administrative access.

What to do

An attacker wielding administrative privileges could exploit this vulnerability to execute arbitrary code or even spawn a root shell. This means they could take complete control over the system, potentially accessing sensitive data, altering configurations, or wreaking absolute havoc! To remediate this vulnerability, ensure your devices are updated to the latest patched version that addresses this flaw. Additionally, implement strict input validation rules to sanitize user input properly. Regular audits of user permissions can also help mitigate the risk. You’ve got this! Fixing this vulnerability will not only secure your systems but also boost your security hero status! 🛡️

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.01828 · 78.7th percentile
Weakness
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Published
2022-08-10T11:18Z
EPSS history
Timeline
  • 10 AUG 11:18Z
    Affected devices do not properly sanitize an input field
    cvelistv5