CVE-2022-31793
High
Description
do_request in request.c in muhttpd before 1.1.7 allows remote attackers to read arbitrary files by constructing a URL with a single character before a desired path on the filesystem. This occurs because the code skips over the first character when serving files. Arris NVG443, NVG599, NVG589, and NVG510 devices and Arris-derived BGW210 and BGW320 devices are affected.
SeverityHigh
CVSS7.5
Exploit probability—
ProductInglorion Muhttpd
PublishedAug 4, 2022
First seenAug 4, 2022
How to fix
Update
- inglorion muhttpd1.1.7 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| inglorion muhttpd | v < 1.1.7 | 1.1.7 |
| arris nvg443_firmware | No range specified | — |
| arris nvg599_firmware | No range specified | — |
| arris nvg589_firmware | No range specified | — |
| arris nvg510_firmware | No range specified | — |
| arris bgw210_firmware | No range specified | — |
| arris bgw320_firmware | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.