CVE-2022-32664 - Vulnerability Details - OpenCVE

Description

In Config Manager, there is a possible command injection due to improper input validation. This could lead to remote escalation of privilege with User execution privileges needed. User interaction is needed for exploitation. Patch ID: A20220004; Issue ID: OSBNB00140929.

Published: 2023-01-03

Score: 8.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

MediaTek, Inc.

EN7516, EN7528, EN7529, EN7561, EN7562, EN7580

affected

Version	Status	Constraints
`Linux SDK versions less than TLM-7.3.293.0`	affected	—

Configuration 1 [-]

AND

cpe:2.3:a:mediatek:linkit_software_development_kit:*:*:*:*:*:*:*:*

cpe:2.3:h:mediatek:en7516:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:a:mediatek:linkit_software_development_kit:*:*:*:*:*:*:*:*

cpe:2.3:h:mediatek:en7528:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:a:mediatek:linkit_software_development_kit:*:*:*:*:*:*:*:*

cpe:2.3:h:mediatek:en7529:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND

cpe:2.3:a:mediatek:linkit_software_development_kit:*:*:*:*:*:*:*:*

cpe:2.3:h:mediatek:en7561:-:*:*:*:*:*:*:*

Configuration 5 [-]

AND

cpe:2.3:a:mediatek:linkit_software_development_kit:*:*:*:*:*:*:*:*

cpe:2.3:h:mediatek:en7562:-:*:*:*:*:*:*:*

Configuration 6 [-]

AND

cpe:2.3:a:mediatek:linkit_software_development_kit:*:*:*:*:*:*:*:*

cpe:2.3:h:mediatek:en7580:-:*:*:*:*:*:*:*

No data.

No data available yet.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
EUVD	EUVD-2022-35730	In Config Manager, there is a possible command injection due to improper input validation. This could lead to remote escalation of privilege with User execution privileges needed. User interaction is needed for exploitation. Patch ID: A20220004; Issue ID: OSBNB00140929.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00703.

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://corp.mediatek.com/product-security-bulletin/January-2023

History

Thu, 10 Apr 2025 16:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Subscriptions

Mediatek En7516 En7528 En7529 En7561 En7562 En7580 Linkit Software Development Kit

MITRE

Status: PUBLISHED

Assigner: MediaTek

Published: 2023-01-03T00:00:00.000Z

Updated: 2025-04-10T15:57:56.050Z

Reserved: 2022-06-09T00:00:00.000Z

Link: CVE-2022-32664

Vulnrichment

Updated: 2024-08-03T07:46:45.278Z

NVD

Status : Modified

Published: 2023-01-03T21:15:12.653

Modified: 2025-04-10T16:15:19.363

Link: CVE-2022-32664

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-77

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-32664", "assignerOrgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374", "assignerShortName": "MediaTek", "dateUpdated": "2025-04-10T15:57:56.050Z", "dateReserved": "2022-06-09T00:00:00.000Z", "datePublished": "2023-01-03T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374", "shortName": "MediaTek", "dateUpdated": "2023-01-03T00:00:00.000Z"}, "descriptions": [{"lang": "en", "value": "In Config Manager, there is a possible command injection due to improper input validation. This could lead to remote escalation of privilege with User execution privileges needed. User interaction is needed for exploitation. Patch ID: A20220004; Issue ID: OSBNB00140929."}], "affected": [{"vendor": "MediaTek, Inc.", "product": "EN7516, EN7528, EN7529, EN7561, EN7562, EN7580", "versions": [{"version": "Linux SDK versions less than TLM-7.3.293.0", "status": "affected"}]}], "references": [{"url": "https://corp.mediatek.com/product-security-bulletin/January-2023"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "Elevation of Privilege"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T07:46:45.278Z"}, "title": "CVE Program Container", "references": [{"url": "https://corp.mediatek.com/product-security-bulletin/January-2023", "tags": ["x_transferred"]}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-77", "lang": "en", "description": "CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-04-10T15:57:21.383399Z", "id": "CVE-2022-32664", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-10T15:57:56.050Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-32664", "assignerOrgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374", "assignerShortName": "MediaTek", "dateUpdated": "2025-04-10T15:57:56.050Z", "dateReserved": "2022-06-09T00:00:00.000Z", "datePublished": "2023-01-03T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374", "shortName": "MediaTek", "dateUpdated": "2023-01-03T00:00:00.000Z"}, "descriptions": [{"lang": "en", "value": "In Config Manager, there is a possible command injection due to improper input validation. This could lead to remote escalation of privilege with User execution privileges needed. User interaction is needed for exploitation. Patch ID: A20220004; Issue ID: OSBNB00140929."}], "affected": [{"vendor": "MediaTek, Inc.", "product": "EN7516, EN7528, EN7529, EN7561, EN7562, EN7580", "versions": [{"version": "Linux SDK versions less than TLM-7.3.293.0", "status": "affected"}]}], "references": [{"url": "https://corp.mediatek.com/product-security-bulletin/January-2023"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "Elevation of Privilege"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T07:46:45.278Z"}, "title": "CVE Program Container", "references": [{"url": "https://corp.mediatek.com/product-security-bulletin/January-2023", "tags": ["x_transferred"]}]}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2022-32664", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-04-10T15:57:21.383399Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-77", "description": "CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-10T15:57:49.895Z"}}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mediatek:linkit_software_development_kit:*:*:*:*:*:*:*:*", "matchCriteriaId": "080D2ABE-FAE2-4091-956B-A269C62B2BD3", "versionEndExcluding": "7.3.293.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:mediatek:en7516:-:*:*:*:*:*:*:*", "matchCriteriaId": "17F70336-68D6-4376-B405-CF2D7E3C607F", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mediatek:linkit_software_development_kit:*:*:*:*:*:*:*:*", "matchCriteriaId": "080D2ABE-FAE2-4091-956B-A269C62B2BD3", "versionEndExcluding": "7.3.293.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:mediatek:en7528:-:*:*:*:*:*:*:*", "matchCriteriaId": "CD990C82-4C61-479B-A49F-11A3C0812AC5", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mediatek:linkit_software_development_kit:*:*:*:*:*:*:*:*", "matchCriteriaId": "080D2ABE-FAE2-4091-956B-A269C62B2BD3", "versionEndExcluding": "7.3.293.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:mediatek:en7529:-:*:*:*:*:*:*:*", "matchCriteriaId": "1A428BF9-1905-4D34-A912-7352739FAD5B", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mediatek:linkit_software_development_kit:*:*:*:*:*:*:*:*", "matchCriteriaId": "080D2ABE-FAE2-4091-956B-A269C62B2BD3", "versionEndExcluding": "7.3.293.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:mediatek:en7561:-:*:*:*:*:*:*:*", "matchCriteriaId": "69D2BB18-DC67-4653-8B0D-32E4C7C015CE", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mediatek:linkit_software_development_kit:*:*:*:*:*:*:*:*", "matchCriteriaId": "080D2ABE-FAE2-4091-956B-A269C62B2BD3", "versionEndExcluding": "7.3.293.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:mediatek:en7562:-:*:*:*:*:*:*:*", "matchCriteriaId": "561E91EF-83A4-4C9C-AB16-EF4F24456787", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mediatek:linkit_software_development_kit:*:*:*:*:*:*:*:*", "matchCriteriaId": "080D2ABE-FAE2-4091-956B-A269C62B2BD3", "versionEndExcluding": "7.3.293.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:mediatek:en7580:-:*:*:*:*:*:*:*", "matchCriteriaId": "061DBB68-80AF-4016-AAE0-EE9DFDFB341B", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In Config Manager, there is a possible command injection due to improper input validation. This could lead to remote escalation of privilege with User execution privileges needed. User interaction is needed for exploitation. Patch ID: A20220004; Issue ID: OSBNB00140929."}, {"lang": "es", "value": "En Config Manager, existe una posible inyecci\u00f3n de comando debido a una validaci\u00f3n de entrada incorrecta. Esto podr\u00eda conducir a una escalada remota de privilegios con privilegios de ejecuci\u00f3n del usuario necesarios. Se necesita la interacci\u00f3n del usuario para la explotaci\u00f3n. ID de parche: A20220004; ID del problema: OSBNB00140929."}], "id": "CVE-2022-32664", "lastModified": "2025-04-10T16:15:19.363", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2023-01-03T21:15:12.653", "references": [{"source": "security@mediatek.com", "tags": ["Vendor Advisory"], "url": "https://corp.mediatek.com/product-security-bulletin/January-2023"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://corp.mediatek.com/product-security-bulletin/January-2023"}], "sourceIdentifier": "security@mediatek.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-77"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-77"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}