CVE-2022-42139
Published: 14 December 2022
Summary
CVE-2022-42139 is a high-severity OS Command Injection (CWE-78) vulnerability in Deltaww Dvw-W02W2-E2 Firmware. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 4.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Delta Electronics DVW-W02W2-E2 version 1.5.0.10 contains an OS command injection vulnerability (CWE-78) that can be triggered through a crafted URL. The flaw received a CVSS 3.1 score of 8.8, reflecting network attack vector, low attack complexity, and low privileges required with no user interaction needed.
An authenticated attacker with network access can supply a malicious URL to execute arbitrary operating-system commands on the device. Successful exploitation grants the attacker full control over confidentiality, integrity, and availability of the affected wireless access point.
The EPSS score for this CVE rose from a low baseline to a peak of 0.4067 on 2025-12-11 before receding to the current value of 0.2200, indicating a period of increased exploitation interest well after the original 2022 disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-45216
Vulnerability details
Delta Electronics DVW-W02W2-E2 1.5.0.10 is vulnerable to Command Injection via Crafted URL.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.