CVE-2022-27226

Deeper analysis

CVE-2022-27226 is a cross-site request forgery vulnerability in the /api/crontab endpoint of iRZ Mobile Routers through March 16, 2022. The flaw permits an attacker to submit a crafted request that creates an arbitrary crontab entry in the device administration interface; the resulting cron job then executes on the attacker-specified schedule, granting remote code execution and filesystem access on the router.

An unauthenticated attacker can trigger the issue by causing an authenticated administrator to visit a malicious page, or can achieve the same outcome without user interaction if the router still uses its factory-default credentials or if valid credentials have been obtained. Successful exploitation yields full control over scheduled tasks, enabling persistent command execution on the affected embedded device.

Public exploit code and detailed proof-of-concept reports have been released, including a Metasploit module and a GitHub repository demonstrating unauthenticated RCE via the CSRF vector. The EPSS score rose sharply from a low baseline to a peak of 0.6667 on 2025-01-22 before receding, indicating a clear post-disclosure increase in exploitation interest that warrants renewed monitoring of exposed iRZ routers.