CVE-2022-27224

moderate-risk
Published 2022-05-09

An issue was discovered in Galleon NTS-6002-GPS 4.14.103-Galleon-NTS-6002.V12 4. An authenticated attacker can perform command injection as root via shell metacharacters within the Network Tools section of the web-management interface. All three networking tools are affected (Ping, Traceroute, and DNS Lookup) and their respective input fields (ping_address, trace_address, nslookup_address).

Do I need to act?

!
13.4% chance of exploitation in next 30 days
EPSS score — higher than 87% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.2/10 High
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Galsys

References (6)

Third Party Advisory https://gist.github.com/somerandomdudeonetheinternet/2caeb201e249160fa82204ef640...
Product https://www.galsys.co.uk/support/software-download.html
Exploit https://www.pentestpartners.com/security-blog/galleon-nts-6002-gps-command-injec...
Third Party Advisory https://gist.github.com/somerandomdudeonetheinternet/2caeb201e249160fa82204ef640...
Product https://www.galsys.co.uk/support/software-download.html
Exploit https://www.pentestpartners.com/security-blog/galleon-nts-6002-gps-command-injec...
43
/ 100
moderate-risk
Severity 26/34 · High
Exploitability 12/34 · Low
Exposure 5/34 · Minimal