Skip to content
OpenAdvisories
High · 8.8 Public exploit CVE-2022-44149 EUVD-2022-47099GHSA-8m32-3cxw-hm8c

The web service on Nexxt Amp300 ARN02304U8 42.103.1.5095 and 80.103.2.5045 devices allows remote OS command execution by placing &telnetd i…

Published Jan 6, 2023 · Updated Apr 9, 2025 · Assigned by mitre

Description

The web service on Nexxt Amp300 ARN02304U8 42.103.1.5095 and 80.103.2.5045 devices allows remote OS command execution by placing &telnetd in the JSON host field to the ping feature of the goform/sysTools component. Authentication is required

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 2 repositories

  • geniuszly/CVE-2022-44149 ★ 5 · Aug 9, 2024

    it is script designed to interact with a router by sending a payload to its system tools. The script retrieves the router's configuration from environment variables to ensure security. It includes fu…

  • yerodin/CVE-2022-44149 ★ 0 · Jan 6, 2023

    POC Exploit for CVE-2022-44149

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References