PT-2022-14876 · Mmp+2 · Mmp+2

Noam Moshe · Published 2022-02-18 · Updated 2022-02-26 · CVE-2022-21143

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions MMP versions prior to 1.0.3 PTP C-series versions prior to 2.8.6.1 PTMP C-series and A5x versions prior to 2.5.4.1

Description The issue is related to improper sanitization of user input in several locations, which may allow an attacker to inject arbitrary commands.

Recommendations For MMP versions prior to 1.0.3, update to version 1.0.3 or later. For PTP C-series versions prior to 2.8.6.1, update to version 2.8.6.1 or later. For PTMP C-series and A5x versions prior to 2.5.4.1, update to version 2.5.4.1 or later.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2022-21143

Affected Products

A5X

Mmp

Ptmp C-Series

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-21143 · Security Note
• https://osv.dev/vulnerability/CVE-2022-21143 · Vendor Advisory
• https://t.me/cibsecurity/37728 · Telegram Post
• https://t.me/cvenotify/27421 · Telegram Post
• https://cisa.gov/uscert/ics/advisories/icsa-22-034-02 · Note