PT-2022-4625 · Centrecom · Centrecom Ar260S V2

Chuya Hayakawa · Published 2022-08-29 · Updated 2022-09-13 · CVE-2022-35273

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions CentreCOM AR260S V2 firmware versions prior to Ver.3.3.7

Description The issue is related to an OS command injection vulnerability in the GUI setting page, allowing a remote authenticated attacker to execute an arbitrary OS command. This vulnerability exists due to the lack of measures to neutralize special elements used in the OS command. Exploitation of this vulnerability may allow an attacker to execute arbitrary shell commands in the target system by sending specially crafted data.

Recommendations For CentreCOM AR260S V2 firmware versions prior to Ver.3.3.7, update to a version Ver.3.3.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the GUI setting page to minimize the risk of exploitation.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2022-05506

CVE-2022-35273

Affected Products

Centrecom Ar260S V2

References · 9

• https://allied-telesis.co.jp/support/list/faq/vuls/20220829.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-05506 · Security Note
• https://osv.dev/vulnerability/CVE-2022-35273 · Vendor Advisory
• https://safe-surf.ru/upload/VULN/VULN-20220901.21.pdf · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-35273 · Security Note
• https://t.me/cibsecurity/49448 · Telegram Post
• https://t.me/cvenotify/35850 · Telegram Post
• https://jvn.jp/en/jp/JVN45473612/index.html · Note
• http://jvn.jp/en/jp/JVN45473612/index.html · Note