CVE-2022-40740

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-40740", "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "assignerShortName": "twcert", "dateUpdated": "2025-04-10T18:01:11.936Z", "dateReserved": "2022-09-15T00:00:00.000Z", "datePublished": "2023-01-03T00:00:00.000Z"}, "containers": {"cna": {"title": "Realtek GPON router - Command Injection", "datePublic": "2022-12-30T00:00:00.000Z", "providerMetadata": {"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "shortName": "twcert", "dateUpdated": "2023-01-03T00:00:00.000Z"}, "descriptions": [{"lang": "en", "value": "Realtek GPON router has insufficient filtering for special characters. A remote attacker authenticated as an administrator can exploit this vulnerability to perform command injection attacks, to execute arbitrary system command, manipulate system or disrupt service."}], "affected": [{"vendor": "Realtek", "product": "GPON router", "versions": [{"version": "SDK 1.9", "status": "affected"}]}], "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-6831-19121-1.html"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-78 OS Command Injection", "cweId": "CWE-78"}]}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "source": {"advisory": "TVN-202212004", "discovery": "EXTERNAL"}, "solutions": [{"lang": "en", "value": "Contact tech support from Realtek"}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T12:28:41.521Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-6831-19121-1.html", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-10T18:01:00.420869Z", "id": "CVE-2022-40740", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-10T18:01:11.936Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-6831-19121-1.html", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T12:28:41.521Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-40740", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-04-10T18:01:00.420869Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-10T18:00:55.490Z"}}], "cna": {"title": "Realtek GPON router - Command Injection", "source": {"advisory": "TVN-202212004", "discovery": "EXTERNAL"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Realtek", "product": "GPON router", "versions": [{"status": "affected", "version": "SDK 1.9"}]}], "solutions": [{"lang": "en", "value": "Contact tech support from Realtek"}], "datePublic": "2022-12-30T00:00:00.000Z", "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-6831-19121-1.html"}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "descriptions": [{"lang": "en", "value": "Realtek GPON router has insufficient filtering for special characters. A remote attacker authenticated as an administrator can exploit this vulnerability to perform command injection attacks, to execute arbitrary system command, manipulate system or disrupt service."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78 OS Command Injection"}]}], "providerMetadata": {"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "shortName": "twcert", "dateUpdated": "2023-01-03T00:00:00.000Z"}}}, "cveMetadata": {"cveId": "CVE-2022-40740", "state": "PUBLISHED", "dateUpdated": "2025-04-10T18:01:11.936Z", "dateReserved": "2022-09-15T00:00:00.000Z", "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "datePublished": "2023-01-03T00:00:00.000Z", "assignerShortName": "twcert"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "GPON router", "vendor": "Realtek", "versions": [{"status": "affected", "version": "SDK 1.9"}]}], "source": "twcert@cert.org.tw"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:realtek:usdk:1.0:*:*:*:*:*:*:*", "matchCriteriaId": "57135300-34FE-47A4-9493-38C59038D1D9", "vulnerable": true}, {"criteria": "cpe:2.3:a:realtek:usdk:2.0:*:*:*:*:*:*:*", "matchCriteriaId": "1CCEF00B-90C7-4079-AE9D-18F4B8F7EF06", "vulnerable": true}, {"criteria": "cpe:2.3:a:realtek:usdk:2.2:*:*:*:*:*:*:*", "matchCriteriaId": "8230CFDF-47B5-430B-97BF-6C4A62DE9F08", "vulnerable": true}, {"criteria": "cpe:2.3:a:realtek:xpon_software_development_kit:1.9:*:*:*:*:*:*:*", "matchCriteriaId": "CBBA9129-7E09-405E-B6FF-567A4DEBD549", "vulnerable": true}, {"criteria": "cpe:2.3:a:realtek:xpon_software_development_kit:3.3:*:*:*:*:*:*:*", "matchCriteriaId": "0926C831-6BAD-499F-ABEB-ACE999EF1D65", "vulnerable": true}, {"criteria": "cpe:2.3:a:realtek:xpon_software_development_kit:4.0:*:*:*:*:*:*:*", "matchCriteriaId": "12E595EC-531C-44A9-BC81-2B852DF6C9E9", "vulnerable": true}, {"criteria": "cpe:2.3:a:realtek:xpon_software_development_kit:4.1:*:*:*:*:*:*:*", "matchCriteriaId": "98BC0768-C674-4E64-8BED-EB7A10846D8A", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Realtek GPON router has insufficient filtering for special characters. A remote attacker authenticated as an administrator can exploit this vulnerability to perform command injection attacks, to execute arbitrary system command, manipulate system or disrupt service."}, {"lang": "es", "value": "El router Realtek GPON tiene un filtrado insuficiente para caracteres especiales. Un atacante remoto autenticado como administrador puede aprovechar esta vulnerabilidad para realizar ataques de inyecci\u00f3n de comandos, ejecutar comandos arbitrarios del sistema, manipular el sistema o interrumpir el servicio."}], "id": "CVE-2022-40740", "lastModified": "2026-06-17T05:01:57.617", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "twcert@cert.org.tw", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2022-40740", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-04-10T18:01:00.420869Z", "version": "2.0.3"}}]}, "published": "2023-01-03T03:15:09.960", "references": [{"source": "twcert@cert.org.tw", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://www.twcert.org.tw/tw/cp-132-6831-19121-1.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://www.twcert.org.tw/tw/cp-132-6831-19121-1.html"}], "sourceIdentifier": "twcert@cert.org.tw", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "twcert@cert.org.tw", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}