CVE-2022-29539

Katalog CVE

CVSS 9.8 · Critical EPSS 1,7%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada resi gemini-net. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

resi-calltrace in RESI Gemini-Net 4.2 is affected by OS Command Injection. It does not properly check the parameters sent as input before they are processed on the server. Due to the lack of validation of user input, an unauthenticated attacker can bypass the syntax intended by the software (e.g., concatenate `&|;\r\ commands) and inject arbitrary system commands with the privileges of the application user.

Rincian

Terbit di NVD

12 Mei 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

1,7% peluang dieksploitasi; lebih tinggi dari 77,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.resi.it/prodotti-soluzioni-commerciali/gemini-network-service-monitoring product · advisory vendor
• https://www.gruppotim.it/it/footer/red-team.html advisory pihak ketiga