CVE-2022-47040 Privilege escalation in n/a
Attackers can escalate privileges on ASKEY routers by exploiting a vulnerability involving tcpdump and crafted files in the /tmp directory.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-47040?
CVE-2022-47040 is a high-severity vulnerability in n/a, published on 24 Jan 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An issue in ASKEY router RTF3505VW-N1 BR_SV_g000_R3505VMN1001_s32_7 allows attackers to escalate privileges via running the tcpdump command after placing a crafted file in the /tmp directory and sending crafted packets through port 80.
Weakness: CWE-276
Which versions are affected by CVE-2022-47040?
It affects 1 product.
Products include Askey Rtf3505vw-N1 Firmware.
How do I fix CVE-2022-47040?
No fix has been published for CVE-2022-47040 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-47040 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-47040 exists.
Sources
Also known as GHSA-p896-8j6m-mwc6.