PT-2022-3878 · Robustel · Robustel R1510

Francesco Benvenuto · Published 2022-06-27 · Updated 2022-10-13 · CVE-2022-33314

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Robustel R1510 version 3.3.0

Description The issue is related to command injection vulnerabilities in the web server action endpoints functionalities. A specially-crafted network request can lead to arbitrary command execution. The /action/import sdk file/ API endpoint is affected by a command injection vulnerability. The vulnerability is due to the lack of neutralization of special elements used in the operating system command, which can be exploited by sending specially-crafted requests to execute arbitrary commands.

Recommendations For Robustel R1510 version 3.3.0, consider disabling the /action/import sdk file/ API endpoint until a patch is available to prevent exploitation. Restrict access to the import sdk file functionality to minimize the risk of arbitrary command execution. Avoid using the import sdk file function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2022-04684

CVE-2022-33314

Affected Products

Robustel R1510

References · 7

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2022-1572 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-33314 · Security Note
• https://osv.dev/vulnerability/CVE-2022-33314 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04684 · Security Note
• https://robustel.com/en/product/r1510-industrial-cellular-vpn-router · Note
• http://blog.talosintelligence.com/2022/06/vuln-spotlight-robustel-cell-router.html · Note
• https://t.me/true_secator/3558 · Telegram Post