CVE-2022-22986

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Netcommunity OG410X and OG810X series (Netcommunity OG410Xa, OG410Xi, OG810Xa, and OG810Xi firmware Ver.2.28 and earlier) allow an attacker on the adjacent network to execute an arbitrary OS command via a specially crafted config file.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Mar 31, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-229879.8The affected product has a hardcoded private key available inside the project folder, which may allow an attacker to achieve Web Server logi CVE-2022-229889.1File and directory permissions have been corrected to prevent unintended users from modifying or accessing resources. It would be more diffi CVE-2022-229899.8My Cloud OS 5 was vulnerable to a pre-authenticated stack overflow vulnerability on the FTP service that could be exploited by unauthenticat CVE-2022-22995.4The Allow SVG Files WordPress plugin through 1.1 does not sanitise uploaded SVG files, which could allow users with a role as low as Author CVE-2022-229908.8A limited authentication bypass vulnerability was discovered that could allow an attacker to achieve remote code execution and escalate priv CVE-2022-229918.8A malicious user on the same LAN could use DNS spoofing followed by a command injection attack to trick a NAS device into loading through an CVE-2022-229929.8A command injection remote code execution vulnerability was discovered on Western Digital My Cloud Devices that could allow an attacker to e CVE-2022-229938.8A limited SSRF vulnerability was discovered on Western Digital My Cloud devices that could allow an attacker to impersonate a server and rea CVE-2022-229949.8A remote code execution vulnerability was discovered on Western Digital My Cloud devices where an attacker could trick a NAS device into loa CVE-2022-229959.8The combination of primitives offered by SMB and AFP in their default configuration allows the arbitrary writing of files. By exploiting the CVE-2022-229967.8The G-RAID 4/8 Software Utility setups for Windows were affected by a DLL hijacking vulnerability. Successful exploitation could lead to arb CVE-2022-229979.8Addressed a remote code execution vulnerability by resolving a command injection vulnerability and closing an AWS S3 bucket that potentially