PT-2022-18827 · Robustel · Robustel R1510

Francesco Benvenuto · Published 2022-06-30 · Updated 2023-07-12 · CVE-2022-28127

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Robustel R1510 version 3.3.0

Description A data removal issue exists in the web server /action/remove/ API functionality. This allows an attacker to send specially-crafted network requests, potentially leading to arbitrary file deletion by sending a sequence of requests to trigger the issue.

Recommendations For Robustel R1510 version 3.3.0, consider disabling the /action/remove/ API endpoint until a patch is available to prevent arbitrary file deletion. Restrict access to this endpoint to minimize the risk of exploitation. Avoid using this functionality in the affected API endpoint until the issue is resolved.

Exploit

Fix

Path traversal

RCE

Weakness Enumeration

CWE-22

CWE-20

Related Identifiers

CVE-2022-28127

Affected Products

Robustel R1510

References · 5

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2022-1571 · Exploit
• https://osv.dev/vulnerability/CVE-2022-28127 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-28127 · Security Note
• https://t.me/cvenotify/54108 · Telegram Post
• https://t.me/true_secator/3558 · Telegram Post