Cyber Resilience

CVE-2022-44149

HighPublic PoCRCE

Published: 06 January 2023

Published
06 January 2023
Modified
09 April 2025
KEV Added
—
Patch
—
CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.8216 99.2th percentile
Risk Priority 67 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-44149 is a high-severity OS Command Injection (CWE-78) vulnerability in Nexxtsolutions Amp300 Firmware. Its CVSS base score is 8.8 (High).

Operationally, ranked in the top 0.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

CVE-2022-44149 is an OS command injection vulnerability (CWE-78) affecting the web service on Nexxt Amp300 ARN02304U8 routers running firmware versions 42.103.1.5095 and 80.103.2.5045. An authenticated user can inject shell metacharacters via the JSON host field supplied to the ping functionality in the goform/sysTools endpoint, resulting in arbitrary command execution on the device.

An attacker with valid credentials can exploit the flaw over the network to run operating-system commands, potentially achieving full control of the router. The CVSS 3.1 score of 8.8 reflects the combination of network reachability, low attack complexity, and high impact on confidentiality, integrity, and availability.

Public references consist primarily of exploit disclosures on Packet Storm and CXSecurity that include proof-of-concept code demonstrating remote code execution; no vendor advisory or firmware patch addressing the issue is referenced in the available sources. The EPSS score has reached a peak of 0.8266 with a current value of 0.8216, indicating sustained exploitation interest after disclosure.

EU & UK References

Vulnerability details

The web service on Nexxt Amp300 ARN02304U8 42.103.1.5095 and 80.103.2.5045 devices allows remote OS command execution by placing &telnetd in the JSON host field to the ping feature of the goform/sysTools component. Authentication is required

CWE(s)
CWE-78

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

nexxtsolutions
amp300 firmware
42.103.1.5095, 80.103.2.5045

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SC-27 Platform-independent Applications
addresses: CWE-78

Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.

SI-10 Information Input Validation
addresses: CWE-78

Validates inputs to block special elements that would alter OS command execution.

References