OS Command Injection Vulnerability in HOME SPOT CUBE2 by AU
CVE-2022-33948

8.8HIGH

Key Information:

Vendor

Kddi Corporation

Status
Home Spot Cube2
Vendor
CVE Published:
4 July 2022

What is CVE-2022-33948?

The HOME SPOT CUBE2 V102 is vulnerable to OS command injection due to inadequate handling of data received from the DHCP server. This vulnerability allows an adjacent attacker to potentially execute arbitrary OS commands if they manage to place a malicious DHCP server on the WAN side of the device, posing significant risks to network integrity and security.

Affected Version(s)

HOME SPOT CUBE2 V102 and earlier

References

https://www.au.com/support/service/mobile/guide/wlan/home...
x_refsource_MISC
https://jvn.jp/en/jp/JVN41017328/index.html
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.