CVE-2022-45717

Name of the Vulnerable Software and Affected Versions IP-COM M50 version 15.11.0.33(10768)

Description The issue is related to a command injection vulnerability. It can be exploited via a crafted GET request to the formSetUSBPartitionUmount function, specifically through the usbPartitionName parameter.

Recommendations For IP-COM M50 version 15.11.0.33(10768), as a temporary workaround, consider restricting access to the formSetUSBPartitionUmount function until a patch is available. Avoid using the usbPartitionName parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.