PT-2022-4491 · Unknown · Home Spot Cube2

Alice Rose · Published 2022-06-20 · Updated 2022-07-15 · CVE-2022-33948

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HOME SPOT CUBE2 version V102

Description The issue is related to an OS command injection vulnerability due to improper processing of data received from a DHCP server. This could allow an adjacent attacker to execute arbitrary OS commands on the product if a malicious DHCP server is placed on the WAN side. The vulnerability is associated with the failure to neutralize special elements used in an OS command.

Recommendations For HOME SPOT CUBE2 version V102, consider restricting access to the WAN side to minimize the risk of exploitation by a malicious DHCP server. As a temporary workaround, until a patch is available, limit the product's exposure to potentially malicious DHCP servers. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2022-05358

CVE-2022-33948

Affected Products

Home Spot Cube2

References · 7

• https://au.com/support/service/mobile/guide/wlan/home_spot_cube_2 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-05358 · Security Note
• https://osv.dev/vulnerability/CVE-2022-33948 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-33948 · Security Note
• https://jvn.jp/en/jp/JVN41017328/index.html · Note
• https://vuldb.com/?id.203184 · Note
• https://t.me/cibsecurity/45554 · Telegram Post