CVE-2022-33329
About
Multiple command injection vulnerabilities exist in the web_server ajax endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network packets can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger these vulnerabilities.The `/ajax/set_sys_time/` API is affected by a command injection vulnerability.
Rainforest analyst review
A time-setting API on the Robustel R1510 industrial router takes attacker-supplied input and passes it straight into a shell. Sending crafted requests to /ajax/set_sys_time/ (and the other affected ajax endpoints) means running commands as the device's web process with no login at all. On a cellular gateway that usually sits at the edge of an OT or branch network, that is effectively a foothold on the boundary between the internet and everything behind it.
Command injection on internet-facing embedded gear is the raw material of IoT botnets. These endpoints get swept indiscriminately by mass scanners looking to conscript routers into DDoS fleets or use them as pivots, and a device like this rarely has EDR or anyone watching its logs. The 9.8 is deserved, but the real driver of urgency is that the box is unmanaged, remotely reachable, and speaks HTTP to anyone who asks.
Our leverage here is inventory of the edge, not the advisory itself. Cellular routers get deployed by field teams and forgotten, so the question we need answered is which R1510 units we actually run, which have their web interface reachable from an untrusted network, and whether that management plane can be pulled off the public internet entirely. For gear this exposed, reducing reachability buys more safety faster than chasing the firmware.
References
Related CVEs
Frequently asked questions
What is CVE-2022-33329?
Multiple command injection vulnerabilities exist in the web_server ajax endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network packets can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger these vulnerabilities.The `/ajax/set_sys_time/` API is affected by a command injection vulnerability.
How severe is CVE-2022-33329?
CVE-2022-33329 carries a CVSS 3.1 base score of 9.8, rated critical. On the Rainforest Risk Index — which weighs the severity alongside how easy the flaw is to reach and how broad its impact is — it scores 99 out of 100, in the critical band.
How is CVE-2022-33329 exploited?
According to the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H): attack vector Network, attack complexity Low, privileges required None, user interaction None. Impact on confidentiality High, integrity High and availability High.
Which products are affected by CVE-2022-33329?
Public advisories list the following as affected: r1510, r1510 firmware. Check the references on this page for the exact versions each vendor confirms.
How do I fix CVE-2022-33329?
Apply the fix the vendor published — the references on this page link to the primary advisories and patches. When patching can't happen right away, reduce the exposure of the affected component and watch it for exploitation attempts. Rainforest customers see this vulnerability correlated to their own assets and prioritized by real exposure, not by score alone.
Empower Your Security Strategy with Rainforest
Discover vulnerabilities early, prioritize critical threats, and protect what truly matters. Rainforest streamlines your security operations, saving you time and reducing costs, so you can focus on what drives your business forward.