A vulnerability, which was classified as very critical, was found in Siretta QUARTZ-GOLD up to G5.0.1.5-210720-141020. Affected is an unknown code of the component Network Handler. The manipulation with an unknown input leads to a os command injection vulnerability. CWE is classifying the issue as CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Several OS command injection vulnerabilities exist in the m2m binary of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted network request can lead to arbitrary command execution. An attacker can send a network request to trigger these vulnerabilities.This command injection is reachable through the m2m's DOWNLOAD_INFO command.

The weakness was presented 01/27/2023 as TALOS-2022-1640. The advisory is shared for download at talosintelligence.com. This vulnerability is traded as CVE-2022-42493 since 10/07/2022. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 02/20/2023). The MITRE ATT&CK project declares the attack technique as T1202.

Applying a patch is able to eliminate this problem.

Productinfo

Vendor

• Siretta

Name

• QUARTZ-GOLD

Version

• G5.0.1.5-210720-141020

License

• commercial

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion