CVE-2022-43367
Published: 27 October 2022
Summary
CVE-2022-43367 is a critical-severity Command Injection (CWE-77) vulnerability in Ip-Com Ew9 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 6.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
IP-COM EW9 V15.11.0.14(9732) contains a command injection vulnerability tracked as CVE-2022-43367 and assigned CWE-77. The flaw resides in the formSetDebugCfg function and carries a CVSS 3.1 base score of 9.8 reflecting network attack vector, low complexity, and no required credentials or user interaction.
An unauthenticated remote attacker can send crafted requests to the affected function and execute arbitrary operating-system commands on the device. Successful exploitation grants full control over the router, enabling confidentiality, integrity, and availability impacts.
Public references consist of a technical disclosure containing proof-of-concept details but do not describe vendor patches or official mitigation steps. The associated EPSS score has remained near 0.12 with only minor fluctuation since publication.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-46406
Vulnerability details
IP-COM EW9 V15.11.0.14(9732) was discovered to contain a command injection vulnerability in the formSetDebugCfg function.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.