CVE-2022-42055

Deeper analysis

CVE-2022-42055 is a command injection vulnerability, tracked under CWE-78, that affects the GL.iNet GoodCloud IoT Device Management System version 1.00.220412.00. The flaw resides in the ping and traceroute diagnostic tools and permits an attacker to inject operating-system commands that result in arbitrary file disclosure on the underlying system. The vulnerability carries a CVSS 3.1 base score of 6.5, reflecting network attack vector, low complexity, and low-privileged access requirements with high impact on confidentiality.

An authenticated user with network access to the management interface can supply crafted input to the ping or traceroute functions. Successful exploitation allows the attacker to read arbitrary files stored on the device without any user interaction or change to the system scope.

Public references point to a technical write-up at boschko.ca/glinet-router that details the injection vectors; however, the supplied references contain no information on vendor patches, work-arounds, or official mitigation guidance.

EPSS scores have remained low, moving only from a peak of 0.0734 to a current value of 0.0711, indicating no material increase in observed exploitation interest after disclosure.