CVE-2022-22279 An arbitrary file read vulnerability in SRA products and older SMA 100 series products.
This issue results from insecure handling of remote file access. An attacker can leverage this issue to upload and execute any remote code on the affected system. This issue can also be exploited by malicious entities to attempt password cracking on the affected system. A post-authentication arbitrary file write vulnerability impacting SRA appliances and older SMA 100 series products running all 9.0.0.5-19v and earlier versions.
This issue results from insecure handling of remote file access. An attacker can leverage this issue to upload and execute any remote code on the affected system. This issue can also be exploited by malicious entities to attempt password cracking on the affected system. A post-authentication arbitrary file write vulnerability impacting SRA appliances and older SMA 100 series products running all 9.0.0.9-26v and earlier versions.
This issue results from insecure handling of remote file access. An attacker can leverage this issue to upload and execute any remote code on the affected system. This issue can also be exploited by malicious entities to attempt password cracking on the affected system. A post-authentication arbitrary file read vulnerability impacting SRA appliances and older SMA 100 series products running all 9.0.0.5-19sv and earlier versions.
This issue results from insecure handling of remote file access. An attacker can leverage this issue to upload and execute any remote code on the affected system
Prerequisites
The following conditions need to be met for this issue to be exploited.
1) The system must have remote file access enabled on the affected appliance.
2) The system must be using an older version of SMA 100 Series firmware that was built before 9.0.0.5-19v or 9.0.0.9-26v
3) An attacker must have valid credentials to log in remotely to the affected appliance
4) An attacker must exploit one of the above mentioned vulnerabilities that enable remote file access on the affected appliance
Vulnerable firmware versions and package names 9.0.0.5-19v
9.0.0.5-19sv
9.0.0.7-26v
9.0.1-26sv
Caching Notifications (CVE-2022-21912)
This issue results from insecure handling of remote file access. An attacker can leverage this issue to upload and execute any remote code on the affected system. This issue can also be exploited by malicious entities to attempt password cracking on the affected system. A post-authentication arbitrary file read vulnerability impacting SRA appliances and older SMA 100 series products running all 9.0.0.5-19v? and earlier versions
Timeline
Published on: 04/13/2022 06:15:00 UTC
Last modified on: 04/21/2022 15:23:00 UTC