CVE-2022-45045 Command injection in n/a
Authenticated attackers can execute arbitrary OS commands as root on Xiongmai NVR devices via crafted JSON upgrade requests.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-45045?
CVE-2022-45045 is a high-severity command injection vulnerability in n/a, published on 1 Dec 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Multiple Xiongmai NVR devices, including MBD6304T V4.02.R11.00000117.10001.131900.00000 and NBD6808T-PL V4.02.R11.C7431119.12001.130000.00000, allow authenticated users to execute arbitrary commands as root, as exploited in the wild starting in approximately 2019. A remote and authenticated attacker, possibly using the default admin:tlJwpbo6 credentials, can connect to port 34567 and execute arbitrary operating system commands via a crafted JSON file during an upgrade request. Since at least 2021, Xiongmai has applied patches to prevent attackers from using this mechanism to execute telnetd.
Weakness: CWE-78
Which versions are affected by CVE-2022-45045?
It affects 144 products.
Products include Xiongmaitech Mbd6304t, Xiongmaitech Mbd6304t Firmware, Xiongmaitech Nbd6808t-Pl, Xiongmaitech Nbd6808t-Pl Firmware, Xiongmaitech Nbd7004t-P, Xiongmaitech Nbd7004t-P Firmware and 138 more.
How do I fix CVE-2022-45045?
No fix has been published for CVE-2022-45045 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2022-45045 being exploited?
There is no known exploitation of CVE-2022-45045 in the wild and no public exploit code.
Sources
Also known as GHSA-rx5h-hxv6-mwc2.