« Volver al listado

CVE-2022-40740

Estado: ModificadaAlta (7.2)—

Realtek GPON router has insufficient filtering for special characters. A remote attacker authenticated as an administrator can exploit this vulnerability to perform command injection attacks, to execute arbitrary system command, manipulate system or disrupt service.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Realtek — UsdkRealtek — Xpon Software Development KIT

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-40740",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-40740",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-10T18:01:00.420869Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "twcert@cert.org.tw",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "twcert@cert.org.tw",
      "affectedData": [
        {
          "vendor": "Realtek",
          "product": "GPON router",
          "versions": [
            {
              "status": "affected",
              "version": "SDK 1.9"
            }
          ]
        }
      ]
    }
  ],
  "published": "2023-01-03T03:15:09.960",
  "references": [
    {
      "url": "https://www.twcert.org.tw/tw/cp-132-6831-19121-1.html",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "twcert@cert.org.tw"
    },
    {
      "url": "https://www.twcert.org.tw/tw/cp-132-6831-19121-1.html",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "twcert@cert.org.tw",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Realtek GPON router has insufficient filtering for special characters. A remote attacker authenticated as an administrator can exploit this vulnerability to perform command injection attacks, to execute arbitrary system command, manipulate system or disrupt service."
    },
    {
      "lang": "es",
      "value": "El router Realtek GPON tiene un filtrado insuficiente para caracteres especiales. Un atacante remoto autenticado como administrador puede aprovechar esta vulnerabilidad para realizar ataques de inyección de comandos, ejecutar comandos arbitrarios del sistema, manipular el sistema o interrumpir el servicio."
    }
  ],
  "lastModified": "2026-06-17T05:01:57.617",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:realtek:usdk:1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "57135300-34FE-47A4-9493-38C59038D1D9"
            },
            {
              "criteria": "cpe:2.3:a:realtek:usdk:2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1CCEF00B-90C7-4079-AE9D-18F4B8F7EF06"
            },
            {
              "criteria": "cpe:2.3:a:realtek:usdk:2.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8230CFDF-47B5-430B-97BF-6C4A62DE9F08"
            },
            {
              "criteria": "cpe:2.3:a:realtek:xpon_software_development_kit:1.9:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CBBA9129-7E09-405E-B6FF-567A4DEBD549"
            },
            {
              "criteria": "cpe:2.3:a:realtek:xpon_software_development_kit:3.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0926C831-6BAD-499F-ABEB-ACE999EF1D65"
            },
            {
              "criteria": "cpe:2.3:a:realtek:xpon_software_development_kit:4.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "12E595EC-531C-44A9-BC81-2B852DF6C9E9"
            },
            {
              "criteria": "cpe:2.3:a:realtek:xpon_software_development_kit:4.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "98BC0768-C674-4E64-8BED-EB7A10846D8A"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "twcert@cert.org.tw"
}