CVE-2022-45699
Published: 10 February 2023
Summary
CVE-2022-45699 is a critical-severity OS Command Injection (CWE-78) vulnerability in Apsystems Ecu-R Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 0.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2022-45699 is a command-injection vulnerability in the administration interface of APSystems ECU-R firmware version 5203. The flaw, tracked under CWE-78 and CWE-94, resides in the handling of the timezone parameter and permits unauthenticated remote attackers to inject and execute operating-system commands.
An attacker with network access to the device can submit a crafted timezone value and obtain arbitrary command execution with root privileges, resulting in complete compromise of the affected ECU-R unit. The vulnerability carries a CVSS 3.1 base score of 9.8, reflecting the absence of required authentication, privileges, or user interaction.
Public references consist of a detailed proof-of-concept repository and demonstration videos that illustrate remote unauthenticated exploitation; no vendor advisory or patch information is included in the supplied references. The CVE maintains a very high EPSS score (current 0.8995, peak 0.9079), indicating sustained exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-48558
Vulnerability details
Command injection in the administration interface in APSystems ECU-R version 5203 allows a remote unauthenticated attacker to execute arbitrary commands as root using the timezone parameter.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates inputs to block special elements that would alter OS command execution.
Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.
Makes persistent code injection into loaded programs impossible when the executable image itself resides on hardware-protected read-only media.
Dynamically generated code can be produced and executed inside the isolated chamber, preventing host compromise from code-injection payloads.
Directly prevents execution of attacker-supplied code written into data memory regions.