CVE-2022-40282

PoC ×2—

CVSS 3.1

8.8 high

EPSS

4%p90

Published

Nov 25, 2022 (Nov 25, 2022)

Modified

Jun 17, 2026

Description

The web server of Hirschmann BAT-C2 before 09.13.01.00R04 allows authenticated command injection. This allows an authenticated attacker to pass commands to the shell of the system because the dir parameter of the FsCreateDir Ajax function is not sufficiently sanitized. The vendor's ID is BSECV-2022-21.

Vendors: belden
Products: hirschmann bat-c2 firmware
Weakness: CWE-77
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (4.1%)

In the news0 stories

No ingested article mentions this CVE yet.