PT-2022-18175 · Arris · Arris Tr3300

Published 2022-03-15 · Updated 2023-08-08 · CVE-2022-26999

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Arris TR3300 version 1.0.13

Description The issue is related to a command injection vulnerability in the static IP settings function. This vulnerability allows attackers to execute arbitrary commands via a crafted request, specifically through the wan ip stat, wan mask stat, wan gw stat, and wan dns1 stat parameters.

Recommendations For Arris TR3300 version 1.0.13, as a temporary workaround, consider restricting access to the static IP settings function until a patch is available. Avoid using the wan ip stat, wan mask stat, wan gw stat, and wan dns1 stat parameters in crafted requests to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2022-26999

Affected Products

Arris Tr3300

References · 4

• 🔥❌ https://github.com/wudipjq/my_vuln/blob/main/ARRIS/vuln_8/8.md · Exploit, Deleted
• https://osv.dev/vulnerability/CVE-2022-26999 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-26999 · Security Note
• https://t.me/cibsecurity/38988 · Telegram Post