CVE-2022-34885 Command injection in MR2600 Router
A local user with elevated permissions can execute arbitrary code on the Motorola MR2600 router due to improper input sanitization.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-34885?
CVE-2022-34885 is a high-severity command injection vulnerability in Motorola MR2600 Router, published on 30 Jan 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
An improper input sanitization vulnerability in the Motorola MR2600 router could allow a local user with elevated permissions to execute arbitrary code.
Weakness: CWE-20
Which versions are affected by CVE-2022-34885?
It affects 1 product.
Products include Motorola Mr2600 Firmware.
How do I fix CVE-2022-34885?
No fix has been published for CVE-2022-34885 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2022-34885 being exploited?
There is no known exploitation of CVE-2022-34885 in the wild and no public exploit code.
Other vulnerabilities in Motorola MR2600 Router
- CVE-2024-23629 Motorola MR2600 Authentication Bypass Vulnerability
- CVE-2024-23626 Motorola MR2600 SaveSysLogParams Command Injection Vulnerability
- CVE-2024-23627 Motorola MR2600 SaveStaticRouteIPv4Params Command Injection Vulnerability
- CVE-2024-23628 Motorola MR2600 SaveStaticRouteIPv6Params Command Injection Vulnerability
- CVE-2024-23630 Motorola MR2600 Arbitrary Firmware Upload Vulnerability
Sources
Also known as GHSA-v7m6-263w-8j68.