RCE in Unimo Udr-Ja1604
CVE-2022-43464
Hidden functionality vulnerability in UDR-JA1604/UDR-JA1608/UDR-JA1616 firmware versions 71x10.1.107112.43A and earlier allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter the device settings.
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.010 (59.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Unimo Udr-ja1604
- Unimo Udr-ja1604_firmware
- Unimo Udr-ja1608
- Unimo Udr-ja1608_firmware
- Unimo Udr-ja1616
- Unimo Udr-ja1616_firmware
- Unimo Technology Co., Ltd Udr-ja1604/udr-ja1608/udr-ja1616 — versions firmware versions 71x10.1.107112.43A and earlier
Weakness classification (CWE)
References
- vultures@jpcert.or.jp (Vendor Advisory)
- vultures@jpcert.or.jp (Third Party Advisory)
Frequently asked questions
- What is CVE-2022-43464?
- CVE-2022-43464 is a high-severity vulnerability in Unimo Udr-Ja1604, classified under OS Command Injection. CVSS score: 8.8/10. Published 2022-12-07.
- How severe is CVE-2022-43464?
- High severity. CVSS v3 base score is 8.8 out of 10.