CVE-2022-29539

Deeper analysis

CVE-2022-29539 is an OS command injection vulnerability (CWE-78) in the resi-calltrace component of RESI Gemini-Net 4.2. The flaw stems from insufficient validation of user-supplied parameters before server-side processing, allowing an attacker to append shell metacharacters such as &|;\r\ and execute arbitrary operating-system commands under the privileges of the application user. The issue received a CVSS 3.1 score of 9.8.

An unauthenticated remote attacker can exploit the vulnerability over the network by sending crafted input to the affected endpoint. Successful exploitation grants the ability to run arbitrary system commands, potentially leading to full compromise of confidentiality, integrity, and availability on the target host.

The EPSS score for this CVE rose from a low baseline after disclosure to a peak of 0.1719 on 2025-12-11 before receding to the current value of 0.0190, indicating a period of increased exploitation interest that later subsided. Public references point to disclosure material from the TIM Red Team and product information hosted on the RESI site, though no specific patch or mitigation guidance is detailed in the available references.