Vulnerability · Published Jul 4, 2022 · Assigned by jpcert
CVE-2022-33948
High 8.8
In plain English
A high-severity security flaw in HOME SPOT CUBE2 from KDDI CORPORATION. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities).
Severity (CVSS NVD)8.8High
Exploit odds (30 days)0.9%top 39.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
HOME SPOT CUBE2 V102 contains an OS command injection vulnerability due to improper processing of data received from DHCP server. An adjacent attacker may execute an arbitrary OS command on the product if a malicious DHCP server is placed on the WAN side of the product.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| KDDI CORPORATION | HOME SPOT CUBE2 | V102 and earlier |
References
- https://www.au.com/support/service/mobile/guide/wlan/home_spot_cube_2/ x_refsource_MISC
- https://jvn.jp/en/jp/JVN41017328/index.html x_refsource_MISC