CVE-2022-36510: H3C GR2200 MiniGR1A0V100R014 was discovered to contain a command injection vulnerability via the param parameter at DelL2tpLNSList

High severity · published Aug 25, 2022

CVE-2022-36510

H3C GR2200 MiniGR1A0V100R014 was discovered to contain a command injection vulnerability via the param parameter at DelL2tpLNSList

7.8

CVSS

10.8%

EPSS

On KEV

Description

H3C GR2200 MiniGR1A0V100R014 was discovered to contain a command injection vulnerability via the param parameter at DelL2tpLNSList.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack vector

Local

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)10.8% · higher than 96% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Gr2200 Firmware · H3c

minigr1a0v100r014 · source: NVD

Affected product

Gr2200 Firmware

H3c

All Gr2200 Firmware CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2022-36510

CVE.org

https://www.cve.org/CVERecord?id=CVE-2022-36510

Exploit

https://github.com/Darry-lang1/vuln/tree/main/H3C/GR2200/1