CVE-2022-31749

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An argument injection vulnerability in the diagnose and import pac commands in WatchGuard Fireware OS before 12.8.1, 12.1.4, and 12.5.10 allows an authenticated remote attacker with unprivileged credentials to upload or read files to limited, arbitrary locations on WatchGuard Firebox and XTM appliances

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-88

Affected software

No affected versions have been published.

Timeline

Published
Jan 28, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2022

CVE-2022-31755.3Missing Custom Error Page in GitHub repository ikus060/rdiffweb prior to 2.4.2.CVE-2022-317515.5The kernel emcom module has multi-thread contention. Successful exploitation of this vulnerability may affect system availability.CVE-2022-317525.5Missing authorization vulnerability in the system components. Successful exploitation of this vulnerability will affect confidentiality.CVE-2022-317537.5The voice wakeup module has a vulnerability of using externally-controlled format strings. Successful exploitation of this vulnerability mayCVE-2022-317547.5Logical defects in code implementation in some products. Successful exploitation of this vulnerability may affect the availability of some fCVE-2022-317555.5The communication module has a vulnerability of improper permission preservation. Successful exploitation of this vulnerability may affect sCVE-2022-317565.5The fingerprint sensor module has design defects. Successful exploitation of this vulnerability may affect data confidentiality.CVE-2022-317577.5The setting module has a vulnerability of improper use of APIs. Successful exploitation of this vulnerability may affect data confidentialitCVE-2022-317584.7The kernel module has the race condition vulnerability. Successful exploitation of this vulnerability may affect data confidentiality.CVE-2022-317595.5AppLink has a vulnerability of accessing uninitialized pointers. Successful exploitation of this vulnerability may affect system availabilitCVE-2022-31767.8There exists a use-after-free in io_uring in the Linux kernel. Signalfd_poll() and binder_poll() use a waitqueue whose lifetime is the curreCVE-2022-317609.1Dialog boxes can still be displayed even if the screen is locked in carrier-customized USSD services. Successful exploitation of this vulner
CVE-2022-31749: Medium severity, CVSS 6.5 | Vulnix