CVE-2022-31208 - An issue was discovered in Infiray IRAY-A8Z3 1.0.957. The webserver contains an endpoint that can ex

CVE-2022-31208

Summary

An issue was discovered in Infiray IRAY-A8Z3 1.0.957. The webserver contains an endpoint that can execute arbitrary commands by manipulating the cmd_string URL parameter.

References

https://sec-consult.com/vulnerability-lab/advisory/infiray-iray-thermal-camera-multiple-vulnerabilities/
https://www.infiray.com/infrared-security-database.html

Vulnerable Configurations

cpe:2.3:o:infiray:iray-a8z3_firmware:1.0.957:*:*:*:*:*:*:*
cpe:2.3:o:infiray:iray-a8z3_firmware:1.0.957:*:*:*:*:*:*:*
cpe:2.3:h:infiray:iray-a8z3:-:*:*:*:*:*:*:*
cpe:2.3:h:infiray:iray-a8z3:-:*:*:*:*:*:*:*

CVSS

Base:	9.0 (as of 25-07-2022 - 03:09)
Impact:
Exploitability:

CWE

NVD-CWE-noinfo

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	SINGLE

Impact

Confidentiality	Integrity	Availability
COMPLETE	COMPLETE	COMPLETE

cvss-vector via4

AV:N/AC:L/Au:S/C:C/I:C/A:C

Last major update

25-07-2022 - 03:09

Published

17-07-2022 - 23:15

Last modified

25-07-2022 - 03:09