PT-2022-19689 · Unknown · Resi Gemini-Net

Alessandro Bosco + 3 · Published 2022-05-12 · Updated 2023-08-08 · CVE-2022-29539

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions RESI Gemini-Net version 4.2

Description The issue is related to OS Command Injection, where the software does not properly check the parameters sent as input before they are processed on the server. Due to the lack of validation of user input, an unauthenticated attacker can bypass the syntax intended by the software and inject arbitrary system commands with the privileges of the application user. This can be achieved by concatenating commands, such as &|;r commands.

Recommendations For RESI Gemini-Net version 4.2, consider implementing input validation to prevent arbitrary system command injection. As a temporary workaround, restrict access to the resi-calltrace component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2022-29539

Affected Products

Resi Gemini-Net

References · 6

• https://osv.dev/vulnerability/CVE-2022-29539 · Vendor Advisory
• https://resi.it/prodotti-soluzioni-commerciali/gemini-network-service-monitoring · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-29539 · Security Note
• https://t.me/cvenotify/30514 · Telegram Post
• https://t.me/cibsecurity/42488 · Telegram Post
• https://gruppotim.it/it/footer/red-team.html · Note