PT-2022-20938 · Arris · Bgw210+5

Derek Abdine

·

Published

2022-08-04

·

Updated

2022-08-20

·

CVE-2022-31793

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions muhttpd versions prior to 1.1.7
Description The issue allows remote attackers to read arbitrary files by constructing a URL with a single character before a desired path on the filesystem. This occurs because the code skips over the first character when serving files. Arris NVG443, NVG599, NVG589, and NVG510 devices and Arris-derived BGW210 and BGW320 devices are affected. An attacker can obtain access to files containing passwords, wireless access settings, provider connection parameters, and private keys.
Recommendations For muhttpd versions prior to 1.1.7, update to version 1.1.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the do request function in request.c until a patch is available. Avoid using specially crafted HTTP requests that could exploit this issue until the update is applied.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-31793

Affected Products

Bgw210
Bgw320
Nvg443
Nvg510
Nvg589
Nvg599