PT-2022-26440 · Generex · Generex Cs141

Published 2022-10-06 · Updated 2022-11-10 · CVE-2022-42457

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Generex CS141 versions 2.08 through 2.10

Description The issue allows remote command execution by administrators via a web interface that reaches run update in /usr/bin/gxserve-update.sh. This can occur, for example, via a reverse shell installed by install.sh.

Recommendations For versions 2.08 through 2.10, update to a version later than 2.10 to resolve the issue. As a temporary workaround, consider restricting access to the run update function in /usr/bin/gxserve-update.sh until a patch is available. Avoid using the install.sh script in the affected API endpoint until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2022-42457

Affected Products

Generex Cs141

References · 9

• 🔥 https://github.com/hubertfarnsworth12/Generex-CS141-Authenticated-Remote-Command-Execution · Exploit
• https://osv.dev/vulnerability/CVE-2022-42457 · Vendor Advisory
• https://generex.de/support/downloads/ups/cs141/update · Vendor Advisory
• https://generex.de/products/ups · Vendor Advisory
• https://generex.de/support/downloads/ups/cs141 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-42457 · Security Note
• https://t.me/cibsecurity/50934 · Telegram Post
• https://t.me/cvenotify/37462 · Telegram Post
• https://github.dev/hubertfarnsworth12/Generex-CS141-Authenticated-Remote-Command-Execution · Note