CVE-2022-38066

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An OS command injection vulnerability exists in the httpd SNMP functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted HTTP response can lead to arbitrary command execution. An attacker can send a network request to trigger this vulnerability.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
Siretta	QUARTZ-GOLD	G5.0.1.5-210720-141020

References

https://talosintelligence.com/vulnerability_reports/TALOS-2022-1615Exploit, Third Party Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2022-1615Exploit, Third Party Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1615

Timeline

Published: Jan 26, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-380675.3Unauthenticated Event Deletion vulnerability in Totalsoft Event Calendar – Calendar plugin <= 1.4.6 at WordPress.CVE-2022-380684.8Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Apasionados Export Post Info plugin <= 1.1.0 at WordPress.CVE-2022-380696.1Multiple globally default credentials exist across all CMS8000 devices, that once exposed, allow a threat actor with momentary physical acce CVE-2022-38076.5A vulnerability was found in Axiomatic Bento4. It has been rated as problematic. Affected by this issue is some unknown functionality of the CVE-2022-380708.8Privilege Escalation (subscriber+) vulnerability in Pop-up plugin <= 1.1.5 at WordPress.CVE-2022-380728.8An improper array index validation vulnerability exists in the stl_fix_normal_directions functionality of ADMesh Master Commit 767a105 and v CVE-2022-380735.4Multiple Authenticated (custom specific plugin role) Persistent Cross-Site Scripting (XSS) vulnerability in Awesome Support plugin <= 6.0.7 CVE-2022-380748.8SQL Injection vulnerability in VeronaLabs WP Statistics plugin <= 13.2.10 versions.CVE-2022-380756.1Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in Mantenimiento web plugin <= 0.13 on WordPres CVE-2022-380767.8Improper input validation in some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software may allow an authenticated user to potentially CVE-2022-380778.8Cross-Site Request Forgery (CSRF) vulnerability in WP OnlineSupport, Essential Plugin Popup Anything – A Marketing Popup and Lead Generation CVE-2022-380789.8Movable Type XMLRPC API provided by Six Apart Ltd. contains a command injection vulnerability. Sending a specially crafted message by POST m