CVE-2022-42139
Description
Delta Electronics DVW-W02W2-E2 firmware 1.5.0.10 is vulnerable to authenticated command injection via a crafted URL with a valid timestamp, allowing arbitrary OS command execution.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Delta Electronics DVW-W02W2-E2 firmware 1.5.0.10 is vulnerable to authenticated command injection via a crafted URL with a valid timestamp, allowing arbitrary OS command execution.
Vulnerability
The web server of the Delta Electronics DVW-W02W2-E2 running firmware version 1.5.0.10 is prone to an authenticated command injection vulnerability. The flaw resides in the apply.cgi endpoint when processing the MT_ping.htm page. Exploitation requires a valid timestamp parameter in the URL, which must be obtained from a prior request or session. [1]
Exploitation
An attacker must first authenticate to the web interface with valid credentials. After obtaining a correct timestamp value, they send a crafted POST request to /apply.cgi?/MT_ping.htm%20timestamp=$correct-timestamp$ with malicious payloads in the POST body (e.g., submit_flag=mt_ping). The proof-of-concept demonstrates opening a reverse shell on port 8889 using utelnetd. [1]
Impact
Successful exploitation grants arbitrary command execution on the underlying operating system with root privileges, leading to full compromise of the device. This can enable further attacks on the industrial network if the device controls critical equipment via serial ports or acts as a key network component. [1]
Mitigation
No official patch has been released by Delta Electronics as of the advisory publication date (August 2022). Users should restrict network access to the device, enforce strong authentication, and monitor for anomalous activity. The device may be end-of-life; contact the vendor for support. [1]
AI Insight generated on May 25, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
2- Delta Electronics/DVW-W02W2-E2description
- Range: = 1.5.0.10
Patches
0No patches discovered yet.
Vulnerability mechanics
Root cause
"Missing input sanitization in the web server's handling of POST parameters allows an attacker to inject arbitrary operating system commands via the "destination" parameter."
Attack vector
An authenticated attacker sends a crafted POST request to `/apply.cgi` with a URL query parameter that includes a valid `timestamp` value and the path `/MT_ping.htm`. The POST body contains the `destination` parameter whose value is wrapped in backticks containing arbitrary shell commands — in the PoC, `utelnetd -p 8889 -l /bin/ash -d` [ref_id=1]. The web server passes this unsanitized input to a shell, executing the injected command on the underlying operating system. The attacker can then connect to the resulting bind shell (e.g., via netcat on port 8889) to gain interactive access to the device [ref_id=1].
Affected code
The vulnerable endpoint is `/apply.cgi` on the device's web server, specifically when invoked with the path `/MT_ping.htm` and a valid `timestamp` query parameter [ref_id=1]. The `destination` POST parameter is the injection point. No source code or patch files are included in the bundle.
What the fix does
The advisory states that the vendor released firmware version V2.5.2 as the fix [ref_id=1]. No patch diff is provided in the bundle, so the exact code change is unknown. The remediation presumably sanitizes or validates the `destination` parameter and other POST inputs before passing them to a shell, preventing command injection. CyberDanube recommends all customers upgrade to firmware version V2.5.2 [ref_id=1].
Preconditions
- authAttacker must have valid authentication credentials (a valid session cookie, e.g., `xxid=1973719449` in the PoC)
- inputAttacker must know or obtain the correct `timestamp` value to include in the URL query string
- networkAttacker must have network access to the device's web server (typically port 80/443)
Reproduction
1. Obtain a valid session cookie and the correct `timestamp` value for the target device. 2. Send the following POST request (adjusting Host, Cookie, and timestamp as needed): `POST /apply.cgi?/MT_ping.htm%20timestamp=$correct-timestamp$ HTTP/1.1` with body `submit_flag=mt_ping&hid_ver1=&hid_ser1=&hid_comm1=&hid_ver2=&hid_ser2=&hid_comm2=&destination=\`utelnetd%20-p%208889%20-l%20/bin/ash%20-d\`` [ref_id=1]. 3. Connect to the bind shell on port 8889 using netcat: `nc <target-ip> 8889` [ref_id=1].
Generated on May 26, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
1News mentions
0No linked articles in our index yet.