CVE-2022-29539 Command injection in n/a
An unauthenticated attacker can inject arbitrary system commands into RESI Gemini-Net via the resi-calltrace component, leading to remote code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-29539?
CVE-2022-29539 is a critical command injection vulnerability in n/a, published on 12 May 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
resi-calltrace in RESI Gemini-Net 4.2 is affected by OS Command Injection. It does not properly check the parameters sent as input before they are processed on the server. Due to the lack of validation of user input, an unauthenticated attacker can bypass the syntax intended by the software (e.g., concatenate `&|;\r\ commands) and inject arbitrary system commands with the privileges of the application user.
Weakness: CWE-78
Which versions are affected by CVE-2022-29539?
It affects 1 product.
Products include Resi Gemini-Net.
How do I fix CVE-2022-29539?
No fix has been published for CVE-2022-29539 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2022-29539 being exploited?
There is no known exploitation of CVE-2022-29539 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-44xc-4fwm-mjj9.