CVE-2022-31793

ÉLEVÉE 7.5CVE-2022-31793 · Published 04/08/2022 · updated 17/06/2026

En bref

CVE-2022-31793 est une vulnérabilité ÉLEVÉE (CVSS 7.5) touchant muhttpd (inglorion).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 17.7%, plus élevée que 97.2% des vulnérabilités.
Correctif : mettre à jour vers 1.1.7 ou plus récent.

Package	Affected versions	Patched versions
muhttpd inglorion	`< 1.1.7`	`1.1.7`

Description

do_request in request.c in muhttpd before 1.1.7 allows remote attackers to read arbitrary files by constructing a URL with a single character before a desired path on the filesystem. This occurs because the code skips over the first character when serving files. Arris NVG443, NVG599, NVG589, and NVG510 devices and Arris-derived BGW210 and BGW320 devices are affected.

References

inglorion.net/software/muhttpd · Third Party Advisory
blog.malwarebytes.com/exploits-and-vulnerabilities/2022/08/millions-of-arris-routers-are-vulnerable-to-path-traversal-attacks · Third Party Advisory
derekabdine.com/blog/2022-arris-advisory · Exploit
kb.cert.org/vuls/id/495801 · Third Party Advisory
kb.cert.org/vuls/id/495801

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free