CVE-2022-29562

A vulnerability in RUGGEDCOM ROX allows an authenticated remote attacker to inject commands into the task scheduler via the Web UI. Lack of proper input sanitization enables arbitrary command execution with root privileges.

A vulnerability in RUGGEDCOM ROX devices allows an authenticated remote attacker to read arbitrary files from the OS filesystem with root privileges. The issue stems from improper input validation in the web server's JSON-RPC interface.

A vulnerability in RUGGEDCOM ROX devices allows an authenticated remote attacker to inject arbitrary commands during feature key installation. Insufficient input sanitization leads to remote code execution with root privileges.

In RUGGEDCOM ROX devices (versions < V2.17.0), under certain conditions IPsec may allow code injection. An attacker could exploit this to execute arbitrary code as root.

In RUGGEDCOM ROX devices (versions < V2.17.0), code injection can be achieved when using VRF (Virtual Routing and Forwarding). An attacker could execute arbitrary code as root.

In RUGGEDCOM ROX devices (versions < V2.17.0), the SCEP client used for secure certificate enrollment lacks validation of multiple fields. An attacker could execute arbitrary code as root.

In RUGGEDCOM ROX devices (versions < V2.17.0), insufficient validation during installation and loading of configuration files allows an attacker to spawn a reverse shell and gain root access.

In RUGGEDCOM ROX devices (versions < V2.17.0), during Dynamic DNS configuration it is possible to inject additional configuration parameters. Under certain circumstances, an attacker could spawn a reverse shell and gain root access.

In RUGGEDCOM ROX products (all versions < V2.17.0), the DHCP Server configuration file is subject to code injection. An attacker could leverage this vulnerability to spawn a reverse shell and gain root access on the affected system.