CVE-2022-32665criticalCWE-77

CVE-2022-32665: critical vulnerability in MediaTek, Inc. EN7528, EN7580

Published · Updated

Follow this CVE+ Monitor EN7528, EN7580

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.8epss 1.6%
In short

Boa has a command injection vulnerability that allows attackers to execute arbitrary commands remotely without needing special permissions or user interaction. This is a critical security flaw that can give attackers complete control over the affected system.

Technical detail

CWE-77 command injection in Boa due to improper input validation allows unauthenticated remote code execution (RCE) with privilege escalation. The vulnerability requires no special execution privileges or user interaction; attack vector is network-based through untrusted input that reaches shell command execution contexts.

Summary generated and translated by AI from the official description.
In Boa, there is a possible command injection due to improper input validation. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: A20220026; Issue ID: OSBNB00144124.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
MediaTek, Inc. · EN7528, EN7580
Related CVEs — MediaTek, Inc. EN7528, EN7580

In the same product, most dangerous first.

CVE-2021-31575CRITICALCVE-2021-31575EPSS 1.7%CVE-2021-31573CRITICALCVE-2021-31573EPSS 1.7%CVE-2021-31574CRITICALCVE-2021-31574EPSS 1.7%CVE-2021-31578—CVE-2021-31578EPSS 1.3%CVE-2021-31577—CVE-2021-31577EPSS 1.1%CVE-2021-31576—CVE-2021-31576EPSS 1.0%