CVE-2022-26999

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the static ip settings function via the wan_ip_stat, wan_mask_stat, wan_gw_stat, and wan_dns1_stat parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/wudipjq/my_vuln/blob/main/ARRIS/vuln_8/8.mdExploit, Third Party Advisory
https://github.com/wudipjq/my_vuln/blob/main/ARRIS/vuln_8/8.mdExploit, Third Party Advisory

Timeline

Published: Mar 15, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-27008.8A vulnerability classified as critical has been found in SourceCodester Gym Management System. This affects an unknown part of the component CVE-2022-270009.8Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the time and time zone function via the h_primary_ntp_se CVE-2022-270019.8Arris TR3300 v1.0.13 were discovered to contain a command injection vulnerability in the dhcp function via the hostname parameter. This vuln CVE-2022-270029.8Arris TR3300 v1.0.13 were discovered to contain a command injection vulnerability in the ddns function via the ddns_name, ddns_pwd, h_ddns、d CVE-2022-270039.8Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnerabil CVE-2022-270049.8Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnerabil CVE-2022-270059.8Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnerabil CVE-2022-270079.8nginx njs 0.7.2 is affected suffers from Use-after-free in njs_function_frame_alloc() when it try to invoke from a restored frame saved with CVE-2022-270087.5nginx njs 0.7.2 is vulnerable to Buffer Overflow. Type confused in Array.prototype.concat() when a slow array appended element is fast array CVE-2022-27016.1A vulnerability classified as problematic was found in SourceCodester Simple E-Learning System. This vulnerability affects unknown code of t CVE-2022-270169.8There is a stack overflow vulnerability in the SetStaticRouteCfg() function in the httpd service of Tenda AC9 15.03.2.21_cn.CVE-2022-27026.5A vulnerability was found in SourceCodester Company Website CMS and classified as critical. Affected by this issue is some unknown functiona