CVE-2022-44149

The web service on Nexxt Amp300 ARN02304U8 42.103.1.5095 and 80.103.2.5045 devices allows remote OS command execution by placing &telnetd in the JSON host…

High · published January 6, 2023

Patch now

High probability of exploitation

CVSS calls it high at 8.8. It sits in the 99.2th percentile for exploit probability.

CVSS v3.1
8.8
EPSS
64%
Percentile
99.2
In the wild
Unconfirmed
What it is

The web service on Nexxt Amp300 ARN02304U8 42.103.1.5095 and 80.103.2.5045 devices allows remote OS command execution by placing &telnetd in the JSON host field to the ping feature of the goform/sysTools component. Authentication is required

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.64354 · 99.2th percentile
Published
2023-01-06T00:00Z
EPSS history
Timeline
  • 06 JAN 00:00Z
    The web service on Nexxt Amp300 ARN02304U8 42.103.1.5095 and 80.103.2.5045 devices allows remote OS command execution by placing &telnetd in the JSON host…
    cvelistv5