CVE-2022-27226
A CSRF issue in /api/crontab on iRZ Mobile Routers through 2022-03-16 allows a threat actor to create a crontab entry in the router administration panel.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- iRZ Mobile Router - CSRF to RCE2022-03-22 · remote · hardware
Impact
A CSRF issue in /api/crontab on iRZ Mobile Routers through 2022-03-16 allows a threat actor to create a crontab entry in the router administration panel. The cronjob will consequently execute the entry on the threat actor's defined interval, leading to remote code execution, allowing the threat actor to gain filesystem access. In addition, if the router's default credentials aren't rotated or a threat actor discovers valid credentials, remote code execution can be achieved without user interaction.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Irz | Ru21 Firmware | through 2022-03-16 |
| Irz | Ru21w Firmware | through 2022-03-16 |
| Irz | Rl21 Firmware | through 2022-03-16 |
| Irz | Ru41 Firmware | through 2022-03-16 |
| Irz | Rl01 Firmware | through 2022-03-16 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/166396/iRZ-Mobile-Router-Cross-Site-Request-Forgery-Remote-Code-Execution.html
- https://en.irz.ru
- https://github.com/SakuraSamuraii/ez-iRZ
- https://johnjhacking.com/blog/cve-2022-27226/
- http://packetstormsecurity.com/files/166396/iRZ-Mobile-Router-Cross-Site-Request-Forgery-Remote-Code-Execution.html
- https://en.irz.ru
- https://github.com/SakuraSamuraii/ez-iRZ
- https://johnjhacking.com/blog/cve-2022-27226/