JVNDB-2022-001477

Vulnerability from jvndb - Published: 2022-03-23 12:08 - Updated:2022-03-23 12:08
Severity ?
8.0 (High) - cvssV3_0 - CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
Netcommunity OG410X and OG810X VoIP gateway/Hikari VoIP adapter for business offices vulnerable to OS command injection
Details
Netcommunity OG410X and OG810X series provided by NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION and NIPPON TELEGRAPH AND TELEPHONE WEST CORPORATION contain an OS command injection vulnerability (CWE-78, CVE-2022-22986). Chuya Hayakawa of 00One, Inc. reported this vulnerability to NTT East and NTT West and coordinated. NTT East, NTT West and JPCERT/CC published respective advisories in order to notify users of this vulnerability.
References
Impacted products
Show details on JVN DB website
To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2022/JVNDB-2022-001477.html",
  "dc:date": "2022-03-23T12:08+09:00",
  "dcterms:issued": "2022-03-23T12:08+09:00",
  "dcterms:modified": "2022-03-23T12:08+09:00",
  "description": "Netcommunity OG410X and OG810X series provided by NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION and NIPPON TELEGRAPH AND TELEPHONE WEST CORPORATION contain an OS command injection vulnerability (CWE-78, CVE-2022-22986).\r\n\r\nChuya Hayakawa of 00One, Inc. reported this vulnerability to NTT East and NTT West and coordinated. NTT East, NTT West and JPCERT/CC published respective advisories in order to notify users of this vulnerability.",
  "link": "https://jvndb.jvn.jp/en/contents/2022/JVNDB-2022-001477.html",
  "sec:cpe": [
    {
      "#text": "cpe:/o:ntt_east:og410xa_firmware",
      "@product": "Netcommunity OG410Xa firmware",
      "@vendor": "NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:ntt_east:og410xi_firmware",
      "@product": "Netcommunity OG410Xi firmware",
      "@vendor": "NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:ntt_east:og810xa_firmware",
      "@product": "Netcommunity OG810Xa firmware",
      "@vendor": "NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:ntt_east:og810xi_firmware",
      "@product": "Netcommunity OG810Xi firmware",
      "@vendor": "NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:ntt_west:netcommunity_0g410xa_firmware",
      "@product": "Netcommunity OG410Xa firmware",
      "@vendor": "NIPPON TELEGRAPH AND TELEPHONE WEST CORPORATION",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:ntt_west:netcommunity_0g410xi_firmware",
      "@product": "Netcommunity OG410Xi firmware",
      "@vendor": "NIPPON TELEGRAPH AND TELEPHONE WEST CORPORATION",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:ntt_west:netcommunity_0g810xa_firmware",
      "@product": "Netcommunity OG810Xa firmware",
      "@vendor": "NIPPON TELEGRAPH AND TELEPHONE WEST CORPORATION",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:ntt_west:netcommunity_0g810xi_firmware",
      "@product": "Netcommunity OG810Xi firmware",
      "@vendor": "NIPPON TELEGRAPH AND TELEPHONE WEST CORPORATION",
      "@version": "2.2"
    }
  ],
  "sec:cvss": [
    {
      "@score": "8.3",
      "@severity": "High",
      "@type": "Base",
      "@vector": "AV:A/AC:L/Au:N/C:C/I:C/A:C",
      "@version": "2.0"
    },
    {
      "@score": "8.0",
      "@severity": "High",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2022-001477",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/vu/JVNVU94900322/index.html",
      "@id": "JVNVU#94900322",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2022-22986",
      "@id": "CVE-2022-22986",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2022-22986",
      "@id": "CVE-2022-22986",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-78",
      "@title": "OS Command Injection(CWE-78)"
    }
  ],
  "title": "Netcommunity OG410X and OG810X VoIP gateway/Hikari VoIP adapter for business offices vulnerable to OS command injection"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.