CVE-2022-42492

Vulnerability

An OS command injection vulnerability exists in the m2m binary of Siretta QUARTZ-GOLD firmware version G5.0.1.5-210720-141020. The vulnerability is triggered via the DOWNLOAD_AD command, which calls m2m_parse_router_config and unsafely passes user-controlled input to the system() function [1]. An attacker can send a specially crafted UDP packet to the m2m service to exploit this.

Exploitation

An unauthenticated attacker with network access to the device can send a specially crafted UDP packet to the m2m service. The packet must include the DOWNLOAD_AD command with malicious payload embedded in parameters. No prior authentication or user interaction is required [1].

Impact

Successful exploitation leads to arbitrary command execution with root privileges, allowing the attacker to fully compromise the device, exfiltrate data, install persistent backdoors, or disrupt network operations [1].

Mitigation

As of the publication date, no patched firmware version has been released. If the m2m service is not required, it should be disabled. Network access to the m2m UDP service should be restricted to trusted hosts only [1].