CVE-2022-32664: mediatek, inc. en7516, en7528, en7529, en7561, en7562, en7580 Command Injection

Vulnerability summary

CVE-2022-32664 is a high (CVSS 8.8) Command Injection vulnerability in mediatek, inc. en7516, en7528, en7529, en7561, en7562, en7580. EPSS estimates a 1.23% chance of exploitation in the next 30 days, higher than 68.4% of scored vulnerabilities.

Timeline

1. 03-01-2023
   PublishedVulnerability first disclosed.
2. 10-04-2025
   Last modifiedVulnerability information updated.

Description

In Config Manager, there is a possible command injection due to improper input validation. This could lead to remote escalation of privilege with User execution privileges needed. User interaction is needed for exploitation. Patch ID: A20220004; Issue ID: OSBNB00140929.

• CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.