CVE-2022-36779

Deeper analysis

CVE-2022-36779 is an unauthenticated OS command injection vulnerability, tracked under CWE-78, that affects multiple Proscend 4G/5G industrial cellular routers with GPS (M330-w, M33-W5, M350-5G, M350-W5G, M350-6, M350-W6, M301-G, M301-GW) as well as the equivalent ADVICE ICR 111WG model. The flaw resides in the web management interface of these devices and permits arbitrary command execution without requiring prior authentication in the reported attack path.

An attacker with adjacent-network access and low privileges can supply crafted input that is passed directly to the underlying operating system, resulting in command execution with limited impact on confidentiality, integrity, and availability within the device’s security context. The CVSS 6.5 score reflects the requirement for adjacent-network adjacency and the constrained scope of the resulting effects.

Public advisories referenced by the Israeli government list the CVE but do not detail specific patches or configuration changes. The associated EPSS score has remained flat at 0.23 since disclosure, indicating no material increase in observed exploitation interest.