{"id":"CVE-2022-3086","aliases":["EUVD-2022-42515","GHSA-g37x-jpmr-w7p9"],"status":"published","title":"Cradlepoint IBR600 Command Injection","description":"Cradlepoint IBR600 NCOS versions 6.5.0.160bc2e and prior are vulnerable \nto shell escape, which enables local attackers with non-superuser \ncredentials to gain full, unrestrictive shell access which may allow an \nattacker to execute arbitrary code.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00319,"percentile":0.25082,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-1263","CWE-77"],"published":"2022-11-29T00:00:00Z","modified":"2026-06-17T04:58:47Z","products":[{"vendor":"cradlepoint","product":"ibr600"},{"vendor":"moxa","product":"uc-2101-lx_firmware"},{"vendor":"moxa","product":"uc-2102-lx_firmware"},{"vendor":"moxa","product":"uc-2104-lx_firmware"},{"vendor":"moxa","product":"uc-2111-lx_firmware"},{"vendor":"moxa","product":"uc-2112-lx_firmware"},{"vendor":"moxa","product":"uc-2114-t-lx_firmware"},{"vendor":"moxa","product":"uc-2116-t-lx_firmware"},{"vendor":"moxa","product":"uc-3101-t-ap-lx_firmware"},{"vendor":"moxa","product":"uc-3101-t-eu-lx_firmware"},{"vendor":"moxa","product":"uc-3101-t-us-lx_firmware"},{"vendor":"moxa","product":"uc-3111-t-ap-lx-nw_firmware"},{"vendor":"moxa","product":"uc-3111-t-ap-lx_firmware"},{"vendor":"moxa","product":"uc-3111-t-eu-lx-nw_firmware"},{"vendor":"moxa","product":"uc-3111-t-eu-lx_firmware"},{"vendor":"moxa","product":"uc-3111-t-us-lx-nw_firmware"},{"vendor":"moxa","product":"uc-3111-t-us-lx_firmware"},{"vendor":"moxa","product":"uc-3121-t-ap-lx_firmware"},{"vendor":"moxa","product":"uc-3121-t-eu-lx_firmware"},{"vendor":"moxa","product":"uc-3121-t-us-lx_firmware"},{"vendor":"moxa","product":"uc-5101-lx_firmware"},{"vendor":"moxa","product":"uc-5101-t-lx_firmware"},{"vendor":"moxa","product":"uc-5102-lx_firmware"},{"vendor":"moxa","product":"uc-5102-t-lx_firmware"},{"vendor":"moxa","product":"uc-5111-lx_firmware"},{"vendor":"moxa","product":"uc-5111-t-lx_firmware"},{"vendor":"moxa","product":"uc-5112-lx_firmware"},{"vendor":"moxa","product":"uc-5112-t-lx_firmware"},{"vendor":"moxa","product":"uc-8112-lx_firmware"},{"vendor":"moxa","product":"uc-8112a-me-t-lx_firmware"},{"vendor":"moxa","product":"uc-8131-lx_firmware"},{"vendor":"moxa","product":"uc-8132-lx_firmware"},{"vendor":"moxa","product":"uc-8162-lx_firmware"},{"vendor":"moxa","product":"uc-8210-t-lx-s_firmware"},{"vendor":"moxa","product":"uc-8220-t-lx-ap-s_firmware"},{"vendor":"moxa","product":"uc-8220-t-lx-eu-s_firmware"},{"vendor":"moxa","product":"uc-8220-t-lx-us-s_firmware"},{"vendor":"moxa","product":"uc-8220-t-lx_firmware"},{"vendor":"moxa","product":"uc-8410a-lx_firmware"},{"vendor":"moxa","product":"uc-8410a-nw-lx_firmware"},{"vendor":"moxa","product":"uc-8410a-nw-t-lx_firmware"},{"vendor":"moxa","product":"uc-8410a-t-lx_firmware"},{"vendor":"moxa","product":"uc-8540-lx_firmware"},{"vendor":"moxa","product":"uc-8540-t-ct-lx_firmware"},{"vendor":"moxa","product":"uc-8540-t-lx_firmware"},{"vendor":"moxa","product":"uc-8580-lx_firmware"},{"vendor":"moxa","product":"uc-8580-q-lx_firmware"},{"vendor":"moxa","product":"uc-8580-t-ct-lx_firmware"},{"vendor":"moxa","product":"uc-8580-t-ct-q-lx_firmware"},{"vendor":"moxa","product":"uc-8580-t-lx_firmware"},{"vendor":"moxa","product":"uc-8580-t-q-lx_firmware"}],"references":[{"url":"https://www.cisa.gov/uscert/ics/advisories/icsa-22-321-02","tags":["x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3086"},{"url":"https://www.cisa.gov/uscert/ics/advisories/icsa-22-333-04"},{"url":"https://github.com/advisories/GHSA-g37x-jpmr-w7p9"}],"sources":{"cve":[{"id":"CVE-2022-3086","title":"Cradlepoint IBR600 Command Injection","description":"Cradlepoint IBR600 NCOS versions 6.5.0.160bc2e and prior are vulnerable \nto shell escape, which enables local attackers with non-superuser \ncredentials to gain full, unrestrictive shell access which may allow an \nattacker to execute arbitrary code.\n\n","status":"published","published":"2022-11-29T00:00:00Z","modified":"2025-04-16T17:42:11.399Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:34:32.843656Z"}],"euvd":[{"id":"EUVD-2022-42515","description":"Cradlepoint IBR600 NCOS versions 6.5.0.160bc2e and prior are vulnerable \nto shell escape, which enables local attackers with non-superuser \ncredentials to gain full, unrestrictive shell access which may allow an \nattacker to execute arbitrary code.\n\n","status":"published","published":"2022-11-29T00:00:00Z","modified":"2025-04-16T17:42:11Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T20:52:23.396616Z"}],"ghsa":[{"id":"GHSA-g37x-jpmr-w7p9","title":"An attacker with physical access to Moxa's bootloader versions of UC-8580 Series V1.1, UC-8540...","description":"An attacker with physical access to Moxa's bootloader versions of UC-8580 Series V1.1, UC-8540 Series V1.0 to V1.2, UC-8410A Series V2.2, UC-8200 Series V1.0 to V2.4, UC-8100A-ME-T Series V1.0 to V1.1, UC-8100 Series V1.2 to V1.3, UC-5100 Series V1.2, UC-3100 Series V1.2 to V2.0, UC-2100 Series V1.3 to V1.5, and UC-2100-W Series V1.3 to V1.5 can initiate a restart of the device and gain access to its BIOS. Command line options can then be altered, allowing the attacker to access the terminal. From the terminal, the attacker can modify the device’s authentication files to create a new user and gain full access to the system.","status":"published","published":"2023-07-06T19:24:05Z","modified":"2024-04-04T05:30:42Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-77","CWE-1263"],"updated_at":"2026-11-02T14:56:32.75662Z"}],"nvd":[{"id":"CVE-2022-3086","description":"Cradlepoint IBR600 NCOS versions 6.5.0.160bc2e and prior are vulnerable \nto shell escape, which enables local attackers with non-superuser \ncredentials to gain full, unrestrictive shell access which may allow an \nattacker to execute arbitrary code.\n\n","status":"published","published":"2022-12-02T20:15:13.767Z","modified":"2026-06-17T04:58:47.9Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:07:32.827264Z"}]}}