CVE-2022-40282: Command Injection
The web server of Hirschmann BAT-C2 before 09.13.01.00R04 allows authenticated command injection. This allows an authenticated attacker to pass commands to the shell of the system because the dir parameter of the FsCreateDir Ajax function is not sufficiently sanitized. The vendor's ID is BSECV-2022-21.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2022-40282.
What is the severity level of CVE-2022-40282?
CVE-2022-40282 has a severity level of 8.8 (High).
What software is affected by CVE-2022-40282?
The Belden Hirschmann Bat-c2 firmware versions up to 09.13.00r04 are affected by CVE-2022-40282.
How can an attacker exploit CVE-2022-40282?
An authenticated attacker can exploit CVE-2022-40282 by passing commands to the system shell through the unsanitized dir parameter of the FsCreateDir Ajax function.
Are there any references available for CVE-2022-40282?
Yes, you can find references for CVE-2022-40282 at the following links: [link1], [link2], [link3].