CVE-2022-27224

Katalog CVE

CVSS 7.2 · High EPSS 4,4%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada galsys nts-6002-gps firmware. Skor CVSS 3.1 7.2 (High) menurut NVD.

Deskripsi (NVD)

An issue was discovered in Galleon NTS-6002-GPS 4.14.103-Galleon-NTS-6002.V12 4. An authenticated attacker can perform command injection as root via shell metacharacters within the Network Tools section of the web-management interface. All three networking tools are affected (Ping, Traceroute, and DNS Lookup) and their respective input fields (ping_address, trace_address, nslookup_address). NOTE: this is disputed by the Supplier because the affected components were never shipped in a production release (they were only present in development releases), and because no privilege boundary is crossed (an applicable "authenticated attacker" always also has the supported ability to make an SSH connection as root).

Rincian

Terbit di NVD

9 Mei 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

4,4% peluang dieksploitasi; lebih tinggi dari 91,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.galsys.co.uk/support/software-download.html product · advisory vendor
• https://gist.github.com/somerandomdudeonetheinternet/2caeb201e249160fa82204ef640c8cdf advisory pihak ketiga
• https://www.pentestpartners.com/security-blog/galleon-nts-6002-gps-command-injection-vulnerability-cve-2022-27... exploit · advisory pihak ketiga
• https://www.galsys.co.uk/manuals/NTS/NTS-6002-V12-web-config-manual.pdf