CVE-2022-0365

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The affected product is vulnerable to an authenticated OS command injection, which may allow an attacker to inject and execute arbitrary shell commands as the Admin (root) user.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
Ricon	Industrial Cellular Router	S9922XL 16.10.3; S9922L 16.10.3

References

https://www.cisa.gov/uscert/ics/advisories/icsa-22-032-01Mitigation, Third Party Advisory, US Government Resource
https://www.cisa.gov/uscert/ics/advisories/icsa-22-032-01Mitigation, Third Party Advisory, US Government Resource

Timeline

Published: Feb 4, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-03668.8An authenticated and authorized agent user could potentially gain administrative access via an SQLi vulnerability to Capsule8 Console betwee CVE-2022-03677.8A heap-based buffer overflow flaw was found in libmodbus in function modbus_reply() in src/modbus.c.CVE-2022-03687.8Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.CVE-2022-03698.8Triangle MicroWorks SCADA Data Gateway Restore Workspace Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows CVE-2022-03705.4Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.CVE-2022-03714.3An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.4 before 14.5.4, all versions starting from 14.6 before CVE-2022-03725.4Cross-site Scripting (XSS) - Stored in Packagist bytefury/crater prior to 6.0.2.CVE-2022-03734.3Improper access control in GitLab CE/EE versions 12.4 to 14.5.4, 14.5 to 14.6.4, and 12.6 to 14.7.1 allows project non-members to retrieve t CVE-2022-03745.4Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.CVE-2022-03754.8Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.CVE-2022-03764.8The User Meta WordPress plugin before 2.4.3 does not sanitise and escape the Form Name, as well as Shared Field Labels before outputting the CVE-2022-03774.3Users of the LearnPress WordPress plugin before 4.1.5 can upload an image as a profile avatar after the registration. After this process th