CVE-2022-33948 Command injection in HOME SPOT CUBE2

High 8.8 Published 4 Jul 2022 Updated 3 Aug 2024

An adjacent attacker can execute arbitrary OS commands on the HOME SPOT CUBE2 by placing a malicious DHCP server on the WAN side.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-33948?

CVE-2022-33948 is a high-severity command injection vulnerability in KDDI CORPORATION HOME SPOT CUBE2, published on 4 Jul 2022. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

HOME SPOT CUBE2 V102 contains an OS command injection vulnerability due to improper processing of data received from DHCP server. An adjacent attacker may execute an arbitrary OS command on the product if a malicious DHCP server is placed on the WAN side of the product.

Weakness: CWE-78

Which versions are affected by CVE-2022-33948?

It affects 1 product.

Products include Kddi Home Spot Cube 2 Firmware.

How do I fix CVE-2022-33948?

No fix has been published for CVE-2022-33948 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2022-33948 being exploited?

There is no known exploitation of CVE-2022-33948 in the wild and no public exploit code.

Sources

Also known as GHSA-352j-2x5m-wf94.