CVE-2022-25916

low-risk

Published 2023-02-01

Versions of the package mt7688-wiscan before 0.8.3 are vulnerable to Command Injection due to improper input sanitization in the 'wiscan.scan' function.

Do I need to act?

0.24% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.4/10 High

LOCAL / HIGH complexity

Affected Products (1)

Mt7688-Wiscan

Affected Vendors

Mt7688-Wiscan Project

References (6)

Broken Link https://github.com/simenkid/mt7688-wiscan/blob/master/index.js%23L22

Patch https://github.com/simenkid/mt7688-wiscan/commit/ff6d6567c65b4e972916a8fbc453321...

Third Party Advisory https://security.snyk.io/vuln/SNYK-JS-MT7688WISCAN-3177394

Broken Link https://github.com/simenkid/mt7688-wiscan/blob/master/index.js%23L22

Patch https://github.com/simenkid/mt7688-wiscan/commit/ff6d6567c65b4e972916a8fbc453321...

Third Party Advisory https://security.snyk.io/vuln/SNYK-JS-MT7688WISCAN-3177394

/ 100

low-risk

Severity 19/34 · Moderate

Exploitability 1/34 · Minimal

Exposure 5/34 · Minimal