CVE-2022-31793

do_request in request.c in muhttpd before 1.1.7 allows remote attackers to read arbitrary files by constructing a URL with a single character before a desired path on the filesystem. This occurs because the code skips over the first character when serving files. Arris NVG443, NVG599, NVG589, and NVG510 devices and Arris-derived BGW210 and BGW320 devices are affected.

• CWE-22

• http://inglorion.net/software/muhttpd/Third Party Advisory
• https://blog.malwarebytes.com/exploits-and-vulnerabilities/2022/08/millions-of-arris-routers-are-vulnerable-to-path-traversal-attacks/Third Party Advisory
• https://derekabdine.com/blog/2022-arris-advisoryExploit, Third Party Advisory
• https://kb.cert.org/vuls/id/495801Third Party Advisory, US Government Resource
• http://inglorion.net/software/muhttpd/Third Party Advisory
• https://blog.malwarebytes.com/exploits-and-vulnerabilities/2022/08/millions-of-arris-routers-are-vulnerable-to-path-traversal-attacks/Third Party Advisory
• https://derekabdine.com/blog/2022-arris-advisoryExploit, Third Party Advisory
• https://kb.cert.org/vuls/id/495801Third Party Advisory, US Government Resource
• https://www.kb.cert.org/vuls/id/495801

Published

Aug 4, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-31788IdeaLMS 2022 allows SQL injection via the IdeaLMS/ChatRoom/C…9.8
• CVE-2022-31789An integer overflow in WatchGuard Firebox and XTM appliances…9.8
• CVE-2022-3179Weak Password Requirements in GitHub repository ikus060/rdif…8.8
• CVE-2022-31790WatchGuard Firebox and XTM appliances allow an unauthenticat…7.5
• CVE-2022-31791WatchGuard Firebox and XTM appliances allow a local attacker…7.8
• CVE-2022-31792A stored cross-site scripting (XSS) vulnerability exists in …5.4
• CVE-2022-31794An issue was discovered on Fujitsu ETERNUS CentricStor CS800…9.8
• CVE-2022-31795An issue was discovered on Fujitsu ETERNUS CentricStor CS800…9.8
• CVE-2022-31796libjpeg 1.63 has a heap-based buffer over-read in Hierarchic…6.5
• CVE-2022-31798Nortek Linear eMerge E3-Series 0.32-07p devices are vulnerab…6.1
• CVE-2022-31799Bottle before 0.12.20 mishandles errors during early request…9.8
• CVE-2022-3180The WPGateway Plugin for WordPress is vulnerable to privileg…9.8