CVE-2022-4002 - A command injection vulnerability could allow an authenticated user to execute operating system commands as root via a specially crafted API request

Back Back to CVE browser

HIGH

A command injection vulnerability could allow an authenticated user to execute operating system commands as root via a specially crafted API request

Published Jul 31, 2024

7.2

HIGH

CVSS 3.1

EPSS 0.95%

Description

A command injection vulnerability could allow an authenticated user to execute operating system commands as root via a specially crafted API request.

Affected products

Vendor Motorola Product Q14 Mesh Router Firmware Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <1.5.0.16

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Motorola

Q14 Mesh Router Firmware

unaffected

Version	Status	Constraints
0	affected	<1.5.0.16

Vendor Motorola Product Q14 Mesh Router Firmware Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <1.5.0.16

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Motorola

Q14 Mesh Router Firmware

n/a

Version	Status	Constraints
0	affected	<1.5.0.16

Remediation

Vendor solution

Update Motorola Q14 Mesh Router firmware to v1.5.0.16 or later.

Weaknesses (2)

CWE-287

Improper Authentication

CWE-77

References (1)

https://en-us.support.motorola.com/app/answers/detail/a_id/176952/~/motorola-q14-mesh-router-vulnerabilities
Vendor Advisory

Link	Providers	Tags
https://en-us.support.motorola.com/app/answers/detail/a_id/176952/~/motorola-q14-mesh-router-vulnerabilities		Vendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner lenovo

Published Jul 31, 2024

Updated Aug 6, 2024

Reserved Nov 15, 2022

Link CVE-2022-4002

CISA Vulnrichment

Updated Aug 6, 2024

NVD

Status Analyzed

Modified Jun 17, 2026

Link CVE-2022-4002

Red Hat

Severity n/a

Public date n/a

Links CVE-2022-4002