CVE-2022-26941: Format string vulnerability in AT+CTGL command in Motorola MTM5000
Published Oct 19, 2023
·Updated
A format string vulnerability exists in Motorola MTM5000 series firmware AT command handler for the AT+CTGL command. An attacker-controllable string is improperly handled, allowing for a write-anything-anywhere scenario. This can be leveraged to obtain arbitrary code execution inside the tedsapp binary, which runs with root privileges.
Affected Software
4 affected components
Motorola Mtm5500 Firmware
Motorola Mtm5500
Motorola Mtm5400 Firmware
Motorola Mtm5400
Event History
Oct 19, 2023
CVE Published
via MITRE·09:35 AM
Data Sourced
via MITRE·09:35 AM
DescriptionSeverityWeakness
Data Sourced
10:15 AM
DescriptionSeverity
Frequently Asked Questions
1
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2022-26941.
2
What is the severity of CVE-2022-26941?
The severity of CVE-2022-26941 is critical with a score of 9.6.
3
What is the affected software in this vulnerability?
The affected software in this vulnerability is Motorola Mtm5500 Firmware and Motorola Mtm5400 Firmware.
4
What is the CWE ID for this vulnerability?
The CWE ID for this vulnerability is CWE-134.
5
Is there a fix available for CVE-2022-26941?
At the moment, there is no information about a fix available for CVE-2022-26941. Please refer to the vendor's security advisory for updates.