Vulnerability · Published May 9, 2022 · Assigned by mitre

CVE-2022-27224

High 7.2

In plain English

A high-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.4% (higher than 91% of all known vulnerabilities).

Severity (CVSS NVD)7.2High

Exploit odds (30 days)4.4%top 8.5% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

An issue was discovered in Galleon NTS-6002-GPS 4.14.103-Galleon-NTS-6002.V12 4. An authenticated attacker can perform command injection as root via shell metacharacters within the Network Tools section of the web-management interface. All three networking tools are affected (Ping, Traceroute, and DNS Lookup) and their respective input fields (ping_address, trace_address, nslookup_address). NOTE: this is disputed by the Supplier because the affected components were never shipped in a production release (they were only present in development releases), and because no privilege boundary is crossed (an applicable "authenticated attacker" always also has the supported ability to make an SSH connection as root).

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

In plain English

Official description

Affected products (as reported)

References