CVE-2022-29516: fujitsu limited ipcom ex2 series, ipcom ex series, ipcom ve2 series, and ipcom va2/ve1 series OS Command Injection

Vulnerability summary

CVE-2022-29516 is a high (CVSS 10.0) OS Command Injection vulnerability in fujitsu limited ipcom ex2 series, ipcom ex series, ipcom ve2 series, and ipcom va2/ve1 series. EPSS estimates a 2.19% chance of exploitation in the next 30 days, higher than 82.1% of scored vulnerabilities.

Timeline

1. 18-05-2022
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

The web console of FUJITSU Network IPCOM series (IPCOM EX2 IN(3200, 3500), IPCOM EX2 LB(1100, 3200, 3500), IPCOM EX2 SC(1100, 3200, 3500), IPCOM EX2 NW(1100, 3200, 3500), IPCOM EX2 DC, IPCOM EX2 DC, IPCOM EX IN(2300, 2500, 2700), IPCOM EX LB(1100, 1300, 2300, 2500, 2700), IPCOM EX SC(1100, 1300, 2300, 2500, 2700), and IPCOM EX NW(1100, 1300, 2300, 2500, 2700)) allows a remote attacker to execute an arbitrary OS command via unspecified vectors.

• CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.