CVE-2022-30105

In Belkin N300 Firmware 1.00.08, the script located at /setting_hidden.asp, which is accessible before and after configuring the device, exhibits multiple remote command injection vulnerabilities. The following parameters in the [form name] form; [list vulnerable parameters], are not properly sanitized after being submitted to the web interface in a POST request. With specially crafted parameters, it is possible to inject a an OS command which will be executed with root privileges, as the web interface, and all processes on the device, run as root.

• CWE-78

• https://www.exploitee.rs/index.php/Belkin_N300#Remote_RootExploit, Third Party Advisory
• https://www.exploitee.rs/index.php/Belkin_N300#Remote_RootExploit, Third Party Advisory

Published

May 18, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-30076ENTAB ERP 1.0 allows attackers to discover users' full names…5.3
• CVE-2022-30078NETGEAR R6200_V2 firmware versions through R6200v2-V1.0.3.12…8.8
• CVE-2022-30079Command injection vulnerability was discovered in Netgear R6…8.8
• CVE-2022-3008The tinygltf library uses the C library function wordexp() t…8.8
• CVE-2022-30083EllieGrid Android Application version 3.4.1 is vulnerable to…9.8
• CVE-2022-3010The Priva TopControl Suite contains predictable credentials …7.5
• CVE-2022-30110The file preview functionality in Jirafeau < 4.4.0, which is…6.1
• CVE-2022-30111Due to the use of an insecure algorithm for rolling codes in…6.8
• CVE-2022-30113Electronic mall system 1.0_build20200203 is affected vulnera…9.8
• CVE-2022-30114A heap-based buffer overflow in a network service in Fastweb…7.5
• CVE-2022-30115Using its HSTS support, curl can be instructed to use HTTPS …4.3
• CVE-2022-30117Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0…9.1