CVE-2022-30105 - CVE House
Back to Database
Status published Critical CVE-2022-30105

In Belkin N300 Firmware 1.00.08, the script located at /setting_hidden.asp,...

Vulnerability Description

In Belkin N300 Firmware 1.00.08, the script located at /setting_hidden.asp, which is accessible before and after configuring the device, exhibits multiple remote command injection vulnerabilities. The following parameters in the [form name] form; [list vulnerable parameters], are not properly sanitized after being submitted to the web interface in a POST request. With specially crafted parameters, it is possible to inject a an OS command which will be executed with root privileges, as the web interface, and all processes on the device, run as root.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-30105

Credits & Attribution

No credits recorded in the NVD database.

References

More from belkin

View All →
CVE-2021-25310
The administration web interface on Belkin Linksys WRT160NL 1.0.04.002_US_20130619 devices...
High 8.8
CVE-2020-26561
Belkin LINKSYS WRT160NL 1.0.04.002_US_20130619 devices have a stack-based buffer overflow...
High 8.8
CVE-2019-17532
An issue was discovered on Belkin Wemo Switch 28B WW_2.00.11057.PVT-OWRT-SNS...
High 7.5
CVE-2019-12780
The Belkin Wemo Enabled Crock-Pot allows command injection in the...
Critical 9.8
CVE-2015-5536
Belkin N300 Dual-Band Wi-Fi Range Extender with firmware before 1.04.10...
Critical 9

Affected Vendor

Affected Software

n300 firmware
Vulnerable Versions:
1.00.08

Timeline

Official Publish: May 18th, 2022
Last Modified: August 3rd, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.