Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2022-40282

The web server of Hirschmann BAT-C2 before 09.13.01.00R04 allows authenticated command injection. This allows an authenticated attacker to pass commands to the shell of the system because the dir parameter of the FsCreateDir Ajax function is not sufficiently sanitized. The vendor's ID is BSECV-2022-21.

Published

2022-11-25T05:15:13.010

Last Modified

2025-04-29T15:15:48.383

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 8.8 (HIGH)

Weaknesses

Type: Primary
NVD-CWE-Other
Type: Secondary
CWE-77

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Operating System	belden	hirschmann_bat-c2_firmware	< 09.13.00r04	Yes
Hardware	belden	hirschmann_bat-c2	-	No

References

http://packetstormsecurity.com/files/170063/Hirschmann-Belden-BAT-C2-8.8.1.0R8-Command-Injection.html Exploit, Third Party Advisory ([email protected])
http://seclists.org/fulldisclosure/2022/Nov/19 Exploit, Third Party Advisory ([email protected])
https://www.belden.com/support/security-assurance Broken Link ([email protected])
http://packetstormsecurity.com/files/170063/Hirschmann-Belden-BAT-C2-8.8.1.0R8-Command-Injection.html Exploit, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://seclists.org/fulldisclosure/2022/Nov/19 Exploit, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.belden.com/support/security-assurance Broken Link (af854a3a-2127-422b-91ae-364da2661108)