CVE-2022-4616

The webserver in Delta DX-3021 versions prior to 1.24 is vulnerable to command injection through the network diagnosis page. This vulnerability could allow a remote unauthenticated user to add files, delete files, and change file permissions.

Affected

Delta Industrial Automation · 4G Router DX-3021

CVSS v3.1 NVD

9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

CVSS v3.1 HQ

7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

4.76% chance of exploitation in the next 30 days, 92nd percentile

Published

2023-01-12

Updated

2025-01-16

Proof-of-concept exploits (1)

• ahanel13/CVE-2022-4616-POC0★ · 2023-05-24

Security advisories

• https://downloadcenter.deltaww.com/en-US/DownloadCenter?v=1&CID=06&itemID=060308&download…
• https://www.cisa.gov/uscert/ics/advisories/icsa-22-354-05

References

• CVE Record
• NVD entry

Related

• CVE-2022-46169