CVE-2022-27226Rl01 Firmware CSRF
A CSRF issue in /api/crontab on iRZ Mobile Routers through 2022-03-16 allows a threat actor to create a crontab entry in the router administration panel.
Published Mar 19, 2022 · Updated Nov 21, 2024
Key Facts
Patch immediately- CVE-2022-27226 is a high-severity vulnerability (CVSS 8.8 v3.1) affecting Rl01 Firmware (Irz), Rl21 Firmware (Irz), Ru21 Firmware (Irz) and 2 more products.
- It is exploited in the wild, listed in Industry KEV feed since Apr 12, 2022. Public exploit code is available.
- EPSS estimates a 34% probability of exploitation in the next 30 days.
- Fixed versions are available, including Rl01 Firmware <=2022-03-16, Rl21 Firmware <=2022-03-16, Ru21 Firmware <=2022-03-16.
- Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Scores
CVSS v3.1
8.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
34%
Higher than 98.3% of all scored CVEs
Exploit maturity
Proof of concept
ATLAS score
43/100
Publication score, see How it works
Exploitation Verdict
KEV listed
Apr 12, 2022
Federal due date
None
No federal due date
Ransomware use
Not reported
Attributed actors
None named
Exploit & Defence Guidance
Exploit maturity
Proof of concept
Public exploit code
3
Proof-of-concept links
In-the-wild evidence
3
Reports of active use
Description
A CSRF issue in /api/crontab on iRZ Mobile Routers through 2022-03-16 allows a threat actor to create a crontab entry in the router administration panel. The cronjob will consequently execute the entry on the threat actor's defined interval, leading to remote code execution, allowing the threat actor to gain filesystem access.
In addition, if the router's default credentials aren't rotated or a threat actor discovers valid credentials, remote code execution can be achieved without user interaction.
Known-Exploited Catalog Listings
| Catalog | Added | Remediation due | Ransomware use |
|---|---|---|---|
| Industry KEV feed | Apr 12, 2022 | n/a | Not reported |
Affected Products
5 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Rl01 FirmwareIrz | See advisory | 2022-03-16 |
| Rl21 FirmwareIrz | See advisory | 2022-03-16 |
| Ru21 FirmwareIrz | See advisory | 2022-03-16 |
| Ru21w FirmwareIrz | See advisory | 2022-03-16 |
| Ru41 FirmwareIrz | See advisory | 2022-03-16 |
Patched Releases
Rl01 Firmware
<=2022-03-16
Rl21 Firmware
<=2022-03-16
Ru21 Firmware
<=2022-03-16
Ru21w Firmware
<=2022-03-16
Ru41 Firmware
<=2022-03-16
Timeline
Publicly disclosed
Mar 19, 2022
Added to Industry KEV feed
Apr 12, 2022
Last updated
Nov 21, 2024
Weakness Type
- CWE-352 Cross-Site Request Forgery (CSRF)
References
- exploitjohnjhacking.com · CVE-2022-27226
- exploitpacketstormsecurity.com · iRZ-Mobile-Router-Cross-Site-Request-Forgery-Re…
- exploitgithub.com · ez-iRZ
- exploitVulnCheck exploitation report
- exploitExploitDB-50832
FAQ
Common Questions.
A CSRF issue in /api/crontab on iRZ Mobile Routers through 2022-03-16 allows a threat actor to create a crontab entry in the router administration panel.
Affected: Rl01 Firmware (Irz); Rl21 Firmware (Irz); Ru21 Firmware (Irz), among others. The full list is in the CVE brief.
It is exploited in the wild, listed in Industry KEV feed since Apr 12, 2022.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including Rl01 Firmware <=2022-03-16, Rl21 Firmware <=2022-03-16, Ru21 Firmware <=2022-03-16.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Is CVE-2022-27226 On Your Attack Surface?
Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.
Request A Demo