CRITICAL🇵🇱 Wersja polska

CVE-2022-26941

CVSS 9.6v3.1pub. 2023-10-19upd. 2024-11-21

A format string vulnerability exists in Motorola MTM5000 series firmware AT command handler for the AT+CTGL command. An attacker-controllable string is improperly handled, allowing for a write-anything-anywhere scenario. This can be leveraged to obtain arbitrary code execution inside the teds_app binary, which runs with root privileges.

CVSS Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

  • Motorola Mtm5400

    HW
    Motorola
    wszystkie wersje

  • Motorola Mtm5400 Firmware

    OS
    Motorola
    wszystkie wersje

  • Motorola Mtm5500

    HW
    Motorola
    wszystkie wersje

  • Motorola Mtm5500 Firmware

    OS
    Motorola
    wszystkie wersje
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCE
CWE
References

Related vulnerabilities

CVE-2022-26942HIGH8.2ten sam produkt

The Motorola MTM5000 series firmwares lack pointer validation on arguments passed to trusted execution environ...

CVE-2022-26943HIGH8.8ten sam produkt

The Motorola MTM5000 series firmwares generate TETRA authentication challenges using a PRNG using a tick count...

CVE-2022-27813HIGH8.1ten sam produkt

Motorola MTM5000 series firmwares lack properly configured memory protection of pages shared between the OMAP-...

CVE-2024-23626CRITICAL9.0PL ✓ten sam vendor

Command injection w parametrze SaveSysLogParams routera Motorola MR2600

CVE-2024-23627CRITICAL9.0PL ✓ten sam vendor

Command injection w parametrze SaveStaticRouteIPv4Params routera Motorola MR2600