CVE-2022-43325

Deeper analysis

CVE-2022-43325 is an unauthenticated command injection vulnerability, tracked under CWE-78, that affects the product license validation function in Telos Alliance Omnia MPX Node versions 1.3.* through 1.4.*. The flaw carries a CVSS 3.1 score of 9.8 and permits remote attackers to supply a crafted payload through the license input field, resulting in arbitrary command execution on the device.

An attacker with network access can exploit the issue without authentication or user interaction by submitting a malicious license string that is processed by the validation routine. Successful exploitation grants full control over the affected appliance, enabling arbitrary code execution with impacts to confidentiality, integrity, and availability.

The associated EPSS score rose from a low baseline after disclosure to a peak of 0.2999 on 2025-12-11 before receding to the current value of 0.1524, indicating that exploitation interest increased well after the initial publication date. Public references consist of proof-of-concept material rather than vendor advisories.