CVE-2022-22140: OS Command Injection

Published Aug 5, 2022

Updated

An os command injection vulnerability exists in the confsrv ucloudaddnode functionality of TCL LinkHub Mesh Wi-Fi MS1G0001.0014. A specially-crafted network packet can lead to arbitrary command execution. An attacker can send a malicious packet to trigger this vulnerability.

Affected Software

2 affected components

Tcl Linkhub Mesh Wifi Ac1200=ms1g_00_01.00_14

Tcl Linkhub Mesh Wifi Ac1200

Event History

Aug 5, 2022

CVE Published

via MITRE·09:11 PM

Data Sourced

via MITRE·09:11 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2022-22140?

CVE-2022-22140 is an os command injection vulnerability in the confsrv ucloud_add_node functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14.

How does CVE-2022-22140 affect TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14?

CVE-2022-22140 allows an attacker to execute arbitrary commands by sending a specially-crafted network packet to the affected device.

What is the severity of CVE-2022-22140?

CVE-2022-22140 has a severity rating of 9.8 (critical).

How can I fix CVE-2022-22140?

To fix CVE-2022-22140, it is recommended to apply the latest security patch or firmware update provided by TCL for the affected device.

Where can I find more information about CVE-2022-22140?

You can find more information about CVE-2022-22140 at the following reference: [https://talosintelligence.com/vulnerability_reports/TALOS-2022-1458]