CVE-2022-31793
Estado: ModificadaAlta (7.5)—
do_request in request.c in muhttpd before 1.1.7 allows remote attackers to read arbitrary files by constructing a URL with a single character before a desired path on the filesystem. This occurs because the code skips over the first character when serving files. Arris NVG443, NVG599, NVG589, and NVG510 devices and Arris-derived BGW210 and BGW320 devices are affected.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Puntuación base: 7.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 17%
- Percentil entre todas las CVEs puntuadas: 97
- Fecha de la puntuación: 5/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (7)
CWE
- CWE-22
Referencias
- http://inglorion.net/software/muhttpd/
- https://blog.malwarebytes.com/exploits-and-vulnerabilities/2022/08/millions-of-arris-routers-are-vulnerable-to-path-traversal-attacks/
- https://derekabdine.com/blog/2022-arris-advisory
- https://kb.cert.org/vuls/id/495801
- http://inglorion.net/software/muhttpd/
- https://blog.malwarebytes.com/exploits-and-vulnerabilities/2022/08/millions-of-arris-routers-are-vulnerable-to-path-traversal-attacks/
- https://derekabdine.com/blog/2022-arris-advisory
- https://kb.cert.org/vuls/id/495801
- https://www.kb.cert.org/vuls/id/495801
JSON original (NVD)
Mostrar
{
"id": "CVE-2022-31793",
"cveTags": [],
"metrics": {
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.5,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 3.6,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2022-08-04T22:15:08.017",
"references": [
{
"url": "http://inglorion.net/software/muhttpd/",
"tags": [
"Third Party Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "https://blog.malwarebytes.com/exploits-and-vulnerabilities/2022/08/millions-of-arris-routers-are-vulnerable-to-path-traversal-attacks/",
"tags": [
"Third Party Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "https://derekabdine.com/blog/2022-arris-advisory",
"tags": [
"Exploit",
"Third Party Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "https://kb.cert.org/vuls/id/495801",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"source": "cve@mitre.org"
},
{
"url": "http://inglorion.net/software/muhttpd/",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://blog.malwarebytes.com/exploits-and-vulnerabilities/2022/08/millions-of-arris-routers-are-vulnerable-to-path-traversal-attacks/",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://derekabdine.com/blog/2022-arris-advisory",
"tags": [
"Exploit",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://kb.cert.org/vuls/id/495801",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.kb.cert.org/vuls/id/495801",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-22"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "do_request in request.c in muhttpd before 1.1.7 allows remote attackers to read arbitrary files by constructing a URL with a single character before a desired path on the filesystem. This occurs because the code skips over the first character when serving files. Arris NVG443, NVG599, NVG589, and NVG510 devices and Arris-derived BGW210 and BGW320 devices are affected."
},
{
"lang": "es",
"value": "La función do_request en el archivo request.c en muhttpd versiones anteriores a 1.1.7, permite a atacantes remotos leer archivos arbitrarios al construir una URL con un solo carácter antes de una ruta deseada en el sistema de archivos. Esto ocurre porque el código salta el primer carácter cuando sirve archivos. Los dispositivos Arris NVG443, NVG599, NVG589 y NVG510 y los dispositivos derivados de Arris BGW210 y BGW320 están afectados"
}
],
"lastModified": "2026-06-17T04:46:19.120",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:inglorion:muhttpd:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CEA107B5-A8F4-4E3E-848B-4D3D986AC0F6",
"versionEndExcluding": "1.1.7"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:arris:nvg443_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D540A232-E544-4289-9857-EB7D599F643B"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:arris:nvg443:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "D323BE0D-6E3C-43D0-870E-3C2A92F6EECF"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:arris:nvg599_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2154F328-30A8-4363-B469-F5306A07FBCF"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:arris:nvg599:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "0677CA25-F914-48FE-8B85-F91776CEB329"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:arris:nvg589_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CAEA6113-6B67-40C2-B31A-8C170854EFBE"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:arris:nvg589:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "03AAE6AE-044C-44DC-8CCA-FF3D646ED19F"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:arris:nvg510_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C18211F5-A1DF-40A6-8D4D-D0FD719F4039"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:arris:nvg510:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "EB87F9D2-CB6F-4E6F-87DA-AFDAAF8BD13C"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:arris:bgw210_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E428B978-B24B-44BF-BCE9-A394793FCBB9"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:arris:bgw210:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "E12A518A-A94B-48F4-9C8B-D24A8D0F16EE"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:arris:bgw320_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "24130786-8DD0-415E-A3D3-F57566F3ADA2"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:arris:bgw320:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "1B033E94-8EA8-4A9D-A8EC-1EE1FFA1BC4D"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "cve@mitre.org"
}