CVE-2022-35270 Denial of service in R1510
An attacker can cause a denial of service on Robustel R1510 devices by sending specially crafted network requests to the web server API.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-35270?
CVE-2022-35270 is a medium-severity denial of service vulnerability in Robustel R1510, published on 25 Oct 2022. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network request can lead to denial of service. An attacker can send a sequence of requests to trigger this vulnerability.This denial of service is in the `/action/import_wireguard_cert_file/` API.
Which versions are affected by CVE-2022-35270?
It affects 1 product.
Products include Robustel R1510 Firmware.
How do I fix CVE-2022-35270?
No fix has been published for CVE-2022-35270 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-35270 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-35270 exists.
Other vulnerabilities in Robustel R1510
Sources
Also known as GHSA-pr4g-6fhr-w57c.