CVE-2022-25916 - Versions of the package mt7688-wiscan before 0.8.3 are vulnerable to Command Injection due to improper input sanitization in the 'wiscan.scan' function

Back Back to CVE browser

HIGH

Versions of the package mt7688-wiscan before 0.8.3 are vulnerable to Command Injection due to improper input sanitization in the 'wiscan.scan' function

Published Feb 1, 2023

7.8

HIGH

CVSS 3.1

EPSS 1.10%

Description

Versions of the package mt7688-wiscan before 0.8.3 are vulnerable to Command Injection due to improper input sanitization in the 'wiscan.scan' function.

Affected products

Vendor n/a Product Mt7688-Wiscan Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <0.8.3

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Mt7688-Wiscan

n/a

Version	Status	Constraints
0	affected	<0.8.3

Ecosystem	Package	Introduced	Fixed
npm	mt7688-wiscan	0	0.8.3

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-77

CWE-78

OS Command Injection

References (5)

https://github.com/advisories/GHSA-5h8c-8ccp-8gmh
Advisory
https://github.com/simenkid/mt7688-wiscan/blob/master/index.js%23L22
Broken Link
https://github.com/simenkid/mt7688-wiscan/commit/ff6d6567c65b4e972916a8fbc4533212f20a2fa5
PatchThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-25916
https://security.snyk.io/vuln/SNYK-JS-MT7688WISCAN-3177394
Third Party Advisory

Link	Providers	Tags
https://github.com/advisories/GHSA-5h8c-8ccp-8gmh		Advisory
https://github.com/simenkid/mt7688-wiscan/blob/master/index.js%23L22		Broken Link
https://github.com/simenkid/mt7688-wiscan/commit/ff6d6567c65b4e972916a8fbc4533212f20a2fa5		PatchThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-25916
https://security.snyk.io/vuln/SNYK-JS-MT7688WISCAN-3177394		Third Party Advisory