PT-2023-8046 · Microchip Technology · Syncserver S650

Barbarisch · Published 2023-02-13 · Updated 2025-03-21 · CVE-2022-40022

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microchip Technology (Microsemi) SyncServer S650 (affected versions not specified)

Description The issue is related to a command injection vulnerability in the web interface of the SyncServer S650 software due to insufficient input validation. This vulnerability can be exploited by a remote attacker to execute arbitrary code.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2024-00023

CVE-2022-40022

Affected Products

Syncserver S650

References · 14

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/symmetricom_syncserver_rce.rb · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-40022 · Security Note
• https://bdu.fstec.ru/vul/2024-00023 · Security Note
• https://microsemi.com/campaigns/network-time-servers/syncserver-s600/?url= · Note
• https://securifera.com/advisories/CVE-2022-40022 · Note
• https://microsemi.com/campaigns/network-time-servers/S650p/%3Fgd%3D1&id=5&gclid=Cj0KCQjwjbyYBhCdARIsAArC6LL-202ej5YfDB5lMIMSZ2735qjo5yaj2i-PrvLv2Cnh_kIJtFJ0oF8aAlMpEALw_wcB · Note
• http://packetstormsecurity.com/files/172907/Symmetricom-SyncServer-Unauthenticated-Remote-Command-Execution.html · Note
• https://microsemi.com/document-portal/doc_download/135737-datasheet-syncserver-s650 · Note
• https://vuldb.com/?id.220811 · Note
• https://t.me/cvenotify/115734 · Telegram Post
• https://microsemi.com/campaigns/network-time-servers/S650p/%3Fgd%3D1&id=5&gclid=Cj0KCQjwjbyYBhCdARIsAArC6LL-202ej5YfDB5lMIMSZ2735qjo5yaj2i-PrvLv2Cnh_kIJtFJ0oF8aAlMpEALw_wcB · Note
• https://t.me/cvenotify/44267 · Telegram Post
• https://t.me/cvenotify/52276 · Telegram Post
• https://t.me/cvenotify/44828 · Telegram Post