CVE-2022-45717
Published: 23 December 2022
Summary
CVE-2022-45717 is a critical-severity OS Command Injection (CWE-78) vulnerability in Ip-Com M50 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 9.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
IP-COM M50 firmware version V15.11.0.33(10768) contains an OS command injection vulnerability (CWE-78) in the formSetUSBPartitionUmount function. The flaw is triggered by the usbPartitionName parameter when the device processes a crafted GET request, and it carries a CVSS 3.1 score of 9.8 reflecting network attack vector, no required credentials or user interaction, and full impact on confidentiality, integrity, and availability.
An unauthenticated remote attacker can exploit the issue by sending a malicious HTTP GET request containing shell metacharacters in the usbPartitionName field. Successful exploitation grants arbitrary command execution on the device, allowing complete compromise of the affected router.
The listed references all point to the same technical write-up on HackMD that describes the vulnerability and proof-of-concept request; no vendor advisory, firmware patch, or mitigation guidance is referenced in the supplied data. The EPSS score has remained flat at 0.0532 with no observed rise after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-48576
Vulnerability details
IP-COM M50 V15.11.0.33(10768) was discovered to contain a command injection vulnerability via the usbPartitionName parameter in the formSetUSBPartitionUmount function. This vulnerability is exploited via a crafted GET request.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.