PT-2022-4622 · Centrecom · Centrecom Ar260S V2

Chuya Hayakawa · Published 2022-08-29 · Updated 2022-09-13 · CVE-2022-38094

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions CentreCOM AR260S V2 firmware versions prior to Ver.3.3.7

Description The issue is related to an OS command injection vulnerability in the telnet function, allowing a remote authenticated attacker to execute arbitrary OS commands. This is due to the lack of measures to neutralize special elements used in the OS command. The exploitation of this issue can enable a remote attacker to execute shell commands on the target system by sending specially crafted data.

Recommendations For CentreCOM AR260S V2 firmware versions prior to Ver.3.3.7, update to a version Ver.3.3.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the telnet function until a patch is available.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2022-05503

CVE-2022-38094

Affected Products

Centrecom Ar260S V2

References · 9

• https://bdu.fstec.ru/vul/2022-05503 · Security Note
• https://allied-telesis.co.jp/support/list/faq/vuls/20220829.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-38094 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-38094 · Security Note
• https://safe-surf.ru/upload/VULN/VULN-20220901.21.pdf · Security Note
• https://t.me/cvenotify/35848 · Telegram Post
• https://t.me/cibsecurity/49445 · Telegram Post
• http://jvn.jp/en/jp/JVN45473612/index.html · Note
• https://jvn.jp/en/jp/JVN45473612/index.html · Note