{"metadata": {"vulnerability": "CVE-2022-36267", "count": 32, "kinds": {"milestone": 4, "sighting": 13, "kev": 6, "other": 9}}, "data": [{"timestamp": "2022-07-18T00:00:00Z", "date_only": false, "value": "2022-07-18T00:00:00.000Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2022-36267", "field": "cveMetadata.dateReserved"}, {"timestamp": "2022-08-08T14:34:15Z", "date_only": false, "value": "2022-08-08T14:34:15.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2022-36267", "field": "cveMetadata.datePublished"}, {"timestamp": "2022-08-08T15:15:00Z", "date_only": false, "value": "2022-08-08T15:15:00Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-W4RX-V2MP-RHF4", "record": "GHSA-W4RX-V2MP-RHF4", "field": "database_specific.nvd_published_at"}, {"timestamp": "2022-08-08T15:15:00Z", "date_only": false, "value": "2022-08-08T15:15Z", "kind": "other", "label": "Published Date", "source": "gsd \u00b7 GSD-2022-36267", "record": "GSD-2022-36267", "field": "namespaces.nvd.nist.gov.publishedDate"}, {"timestamp": "2022-08-08T15:15:09.083Z", "date_only": false, "value": "2022-08-08T15:15:09.083", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2022-36267", "record": "FKIE_CVE-2022-36267", "field": "published"}, {"timestamp": "2022-08-08T18:23:55Z", "date_only": false, "value": "2022-08-08T18:23:55.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cibsecurity/47741", "record": "CVE-2022-36267", "field": "creation_timestamp", "uuid": "c09552c3-d3d6-4ad9-8b33-5594ff80880f", "content": "\u203c CVE-2022-36267 \u203c\n\nIn Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists a Unauthenticated remote command injection vulnerability. The ping functionality can be called without user authentication when crafting a malicious http request by injecting code in one of the parameters allowing for remote code execution. This vulnerability is exploited via the binary file /home/www/cgi-bin/diagnostics.cgi that accepts unauthenticated requests and unsanitized data. As a result, a malicious actor can craft a specific request and interact remotely with the device.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "url": "https://t.me/cibsecurity/47741"}, {"timestamp": "2022-08-09T00:00:25Z", "date_only": false, "value": "2022-08-09T00:00:25Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-W4RX-V2MP-RHF4", "record": "GHSA-W4RX-V2MP-RHF4", "field": "published"}, {"timestamp": "2022-08-10T17:06:27Z", "date_only": false, "value": "2022-08-10T17:06:27.000Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / mitre", "record": "CVE-2022-36267", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2022-08-12T15:00:00Z", "date_only": false, "value": "2022-08-12T15:00Z", "kind": "other", "label": "Last Modified Date", "source": "gsd \u00b7 GSD-2022-36267", "record": "GSD-2022-36267", "field": "namespaces.nvd.nist.gov.lastModifiedDate"}, {"timestamp": "2022-08-13T00:00:52Z", "date_only": false, "value": "2022-08-13T00:00:52Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-W4RX-V2MP-RHF4", "record": "GHSA-W4RX-V2MP-RHF4", "field": "modified"}, {"timestamp": "2023-02-19T12:43:33Z", "date_only": false, "value": "2023-02-19T12:43:33.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/JerusalemElectronicArmy/179", "record": "CVE-2022-36267", "field": "creation_timestamp", "uuid": "1f3d0d5c-04cf-41c8-bb81-a009a8de7ec2", "content": "#\u0627\u062e\u0628\u0627\u0631_\u0633\u0627\u064a\u0628\u0631 \n\u062a\u0642\u0631\u064a\u0631 \u064a\u062a\u062d\u062f\u062b \u0639\u0646 \u0647\u062c\u0645\u0627\u062a \u062a\u0633\u0645\u0649 Mirai Botnet  \u0644\u0627\u0633\u062a\u0647\u062f\u0627\u0641 \u0623\u062c\u0647\u0632\u0629 Linux \u0648\u0625\u0646\u062a\u0631\u0646\u062a \u0627\u0644\u0623\u0634\u064a\u0627\u0621\n\u0639\u0646 \u0637\u0631\u064a\u0642 \u0627\u0633\u062a\u063a\u0644\u0627\u0644 \u0627\u0644\u062b\u063a\u0631\u0627\u062a \u0627\u0644\u062a\u0627\u0644\u064a\u0629:\n\n    CVE-2012-4869: FreePBX Elastix Remote Command Execution Vulnerability\n    Gitorious Remote Command Execution Vulnerability\n    CVE-2014-9727: FRITZ!Box Webcam Remote Command Execution Vulnerability\n    Mitel AWC Remote Command Execution Vulnerability\n    CVE-2017-5173: Geutebruck IP Cameras Remote Command Execution Vulnerability\n    CVE-2019-15107: Webmin Command Injection Vulnerability\n    Spree Commerce Arbitrary Command Execution Vulnerability\n    FLIR Thermal Camera Remote Command Execution Vulnerability\n    CVE-2020-8515: DrayTek Vigor Remote Command Execution Vulnerability\n    CVE-2020-15415: DrayTek Vigor Remote Command Injection Vulnerability\n    CVE-2022-36267: Airspan AirSpot Remote Command Execution Vulnerability\n    CVE-2022-26134: Atlassian Confluence Remote Code Execution Vulnerability\n    CVE-2022-4257: C-Data Web Management System Command Injection Vulnerability\n\nhttps://unit42.paloaltonetworks.com/mirai-variant-v3g4/", "url": "https://t.me/JerusalemElectronicArmy/179"}, {"timestamp": "2023-12-13T01:19:21.418Z", "date_only": false, "value": "2023-12-13T01:19:21.418873Z", "kind": "other", "label": "Updated", "source": "gsd \u00b7 GSD-2022-36267", "record": "GSD-2022-36267", "field": "gsd.osvSchema.modified"}, {"timestamp": "2024-01-09T14:34:03Z", "date_only": false, "value": "2024-01-09T14:34:03.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/arpsyndicate/2754", "record": "CVE-2022-36267", "field": "creation_timestamp", "uuid": "c05408d6-30fb-43e8-8e97-3deaa1c9de1f", "content": "#ExploitObserverAlert\n\nCVE-2022-36267\n\nDESCRIPTION: Exploit Observer has 6 entries related to CVE-2022-36267. In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists a Unauthenticated remote command injection vulnerability. The ping functionality can be called without user authentication when crafting a malicious http request by injecting code in one of the parameters allowing for remote code execution. This vulnerability is exploited via the binary file /home/www/cgi-bin/diagnostics.cgi that accepts unauthenticated requests and unsanitized data. As a result, a malicious actor can craft a specific request and interact remotely with the device.\n\nFIRST-EPSS: 0.694210000\nNVD-IS: 5.9\nNVD-ES: 3.9", "url": "https://t.me/arpsyndicate/2754"}, {"timestamp": "2024-01-10T03:34:04Z", "date_only": false, "value": "2024-01-10T03:34:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/hackingbra/63", "record": "CVE-2022-36267", "field": "creation_timestamp", "uuid": "5a9c6476-4292-49b9-8e68-1cff16e00169", "content": "#exploit\n1. CVE-2023-40713:\nExploiting GOG Galaxy XPC service for privilege escalation in macOS\nhttps://securityintelligence.com/x-force/exploiting-gog-galaxy-xpc-service-privilege-escalation-macos\n\n2. CVE-2023-6560:\nio_uring_io_uaddr_map() Dangerous Multi-Page Handling\nhttps://packetstormsecurity.com/files/176405/io_uring-__io_uaddr_map-Dangerous-Multi-Page-Handling.html\n\n3. CVE-2022-36267:\nAirspan AirSpot 5410 - Unauth Remote CI\nhttps://github.com/0xNslabs/CVE-2022-36267-PoC", "url": "https://t.me/hackingbra/63"}, {"timestamp": "2024-01-10T10:59:58Z", "date_only": false, "value": "2024-01-10T10:59:58.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CyberSecurityTechnologies/9759", "record": "CVE-2022-36267", "field": "creation_timestamp", "uuid": "c1101ea2-6fa5-4f6f-928a-061c8c953323", "content": "#exploit\n1. CVE-2023-40713:\nExploiting GOG Galaxy XPC service for privilege escalation in macOS\nhttps://securityintelligence.com/x-force/exploiting-gog-galaxy-xpc-service-privilege-escalation-macos\n\n2. CVE-2023-6560:\nio_uring_io_uaddr_map() Dangerous Multi-Page Handling\nhttps://packetstormsecurity.com/files/176405/io_uring-__io_uaddr_map-Dangerous-Multi-Page-Handling.html\n\n3. CVE-2022-36267:\nAirspan AirSpot 5410 - Unauth Remote CI\nhttps://github.com/0xNslabs/CVE-2022-36267-PoC", "url": "https://t.me/CyberSecurityTechnologies/9759"}, {"timestamp": "2024-03-11T07:14:50Z", "date_only": false, "value": "2024-03-11T07:14:50.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CyberSecurityTechnologies/10122", "record": "CVE-2022-36267", "field": "creation_timestamp", "uuid": "b41943dc-6b96-4526-9594-0d147a4e8baf", "content": "#exploit\n1. CVE-2023-36049:\nMicrosoft .NET CRLF Injection Arbitrary File Write/Deletion\nhttps://www.zerodayinitiative.com/blog/2024/3/6/cve-2023-36049-microsoft-net-crlf-injection-arbitrary-file-writedeletion-vulnerability\n\n2. CVE-2022-36266, CVE-2022-36267, CVE-2022-36264, CVE-2022-36265:\nAirspan AirSpot 5410 Vulnerabilities\nhttps://neroteam.com/blog/airspan-airspot-5410-vulnerability-report", "url": "https://t.me/CyberSecurityTechnologies/10122"}, {"timestamp": "2024-05-15T10:49:15Z", "date_only": false, "value": "2024-05-15T10:49:15+00:00", "kind": "kev", "label": "Asserted", "source": "shadowserver", "record": "CVE-2022-36267", "field": "timestamps.asserted_at", "uuid": "44d5133b-9799-4fb3-8950-0855dd2b5573", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2024-05-15T10:49:15Z", "date_only": false, "value": "2024-05-15T10:49:15+00:00", "kind": "kev", "label": "First seen", "source": "shadowserver", "record": "CVE-2022-36267", "field": "timestamps.first_seen_at", "uuid": "44d5133b-9799-4fb3-8950-0855dd2b5573", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2024-08-03T10:00:04.316Z", "date_only": false, "value": "2024-08-03T10:00:04.316Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2022-36267", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2024-08-03T10:00:04.316Z", "date_only": false, "value": "2024-08-03T10:00:04.316Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "CVE-2022-36267", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2024-08-16T09:01:20Z", "date_only": false, "value": "2024-08-16T09:01:20.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/Rootsec_2/2468", "record": "CVE-2022-36267", "field": "creation_timestamp", "uuid": "663bf77f-59b2-464a-adda-7c85b112b123", "content": "#exploit\n1. CVE-2023-40713:\nExploiting GOG Galaxy XPC service for privilege escalation in macOS\nhttps://securityintelligence.com/x-force/exploiting-gog-galaxy-xpc-service-privilege-escalation-macos\n\n2. CVE-2023-6560:\nio_uring_io_uaddr_map() Dangerous Multi-Page Handling\nhttps://packetstormsecurity.com/files/176405/io_uring-__io_uaddr_map-Dangerous-Multi-Page-Handling.html\n\n3. CVE-2022-36267:\nAirspan AirSpot 5410 - Unauth Remote CI\nhttps://github.com/0xNslabs/CVE-2022-36267-PoC", "url": "https://t.me/Rootsec_2/2468"}, {"timestamp": "2024-09-14T00:00:00Z", "date_only": false, "value": "2024-09-14T00:00:00+00:00", "kind": "kev", "label": "Last seen", "source": "shadowserver", "record": "CVE-2022-36267", "field": "timestamps.last_seen_at", "uuid": "44d5133b-9799-4fb3-8950-0855dd2b5573", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2024-09-14T00:00:00Z", "date_only": true, "value": "2024-09-14", "kind": "kev", "label": "Observation date", "source": "shadowserver", "record": "CVE-2022-36267", "field": "evidence.0.details.observation_date", "uuid": "44d5133b-9799-4fb3-8950-0855dd2b5573", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2024-09-14T00:00:00Z", "date_only": false, "value": "2024-09-14T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "shadowserver", "record": "CVE-2022-36267", "field": "status.status_updated_at", "uuid": "44d5133b-9799-4fb3-8950-0855dd2b5573", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2025-08-31T03:13:01Z", "date_only": false, "value": "2025-08-31T03:13:01.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/d17bd6ef-d68b-317b-ac33-cdbc44c5fc57", "record": "CVE-2022-36267", "field": "creation_timestamp", "uuid": "cf1f3d1e-de22-492e-9cd3-72f9e2ac96c0"}, {"timestamp": "2026-06-17T04:53:09.043Z", "date_only": false, "value": "2026-06-17T04:53:09.043", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2022-36267", "record": "FKIE_CVE-2022-36267", "field": "lastModified"}, {"timestamp": "2026-06-23T14:06:15.053Z", "date_only": false, "value": "2026-06-23T14:06:15.053718Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/685b784c-f7bb-4c51-bc6d-825ac66436ca", "record": "CVE-2022-36267", "field": "creation_timestamp", "uuid": "eb70d884-309c-48c6-bd20-032a7d2ade31", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/685b784c-f7bb-4c51-bc6d-825ac66436ca"}, {"timestamp": "2026-06-30T12:19:14.492Z", "date_only": false, "value": "2026-06-30T12:19:14.492465Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/52134ace-e66d-493f-80a9-fcdb386480ce", "record": "CVE-2022-36267", "field": "creation_timestamp", "uuid": "5df11357-9b68-4576-807b-720f9be1b537", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/52134ace-e66d-493f-80a9-fcdb386480ce"}, {"timestamp": "2026-07-01T09:12:38.337Z", "date_only": false, "value": "2026-07-01T09:12:38.337021Z", "kind": "sighting", "label": "Exploited", "source": "https://db.gcve.eu/known-exploited-vulnerabilities-catalog/44d5133b-9799-4fb3-8950-0855dd2b5573", "record": "CVE-2022-36267", "field": "creation_timestamp", "uuid": "23a59101-8866-4825-9685-a0025f6c7116", "url": "https://db.gcve.eu/known-exploited-vulnerabilities-catalog/44d5133b-9799-4fb3-8950-0855dd2b5573"}, {"timestamp": "2026-07-01T12:47:07Z", "date_only": false, "value": "2026-07-01T12:47:07+00:00", "kind": "kev", "label": "Recorded", "source": "shadowserver", "record": "CVE-2022-36267", "field": "timestamps.recorded_at", "uuid": "44d5133b-9799-4fb3-8950-0855dd2b5573", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-01T20:01:26.430Z", "date_only": false, "value": "2026-09-01T20:01:26.430782Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/hacking_Attack/64962", "record": "CVE-2022-36267", "field": "creation_timestamp", "uuid": "5b9df576-ef8a-4514-a1ac-9bcd53c0b0f1", "url": "https://t.me/hacking_Attack/64962"}, {"timestamp": "2026-09-05T12:00:05.856Z", "date_only": false, "value": "2026-09-05T12:00:05.856750Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/hacking_Attack/64962", "record": "CVE-2022-36267", "field": "creation_timestamp", "uuid": "b0470cd1-f60f-44d3-9151-36bc48ead50c", "url": "https://t.me/hacking_Attack/64962"}]}