CVE-2022-40282

The web server of Hirschmann BAT-C2 before 09.13.01.00R04 allows authenticated command injection. This allows an authenticated attacker to pass commands to the shell of the system because the dir parameter of the FsCreateDir Ajax function is not sufficiently sanitized. The vendor's ID is BSECV-2022-21.

• CWE-77

• http://packetstormsecurity.com/files/170063/Hirschmann-Belden-BAT-C2-8.8.1.0R8-Command-Injection.htmlExploit, Third Party Advisory
• http://seclists.org/fulldisclosure/2022/Nov/19Exploit, Third Party Advisory
• https://www.belden.com/support/security-assuranceBroken Link
• http://packetstormsecurity.com/files/170063/Hirschmann-Belden-BAT-C2-8.8.1.0R8-Command-Injection.htmlExploit, Third Party Advisory
• http://seclists.org/fulldisclosure/2022/Nov/19Exploit, Third Party Advisory
• https://www.belden.com/support/security-assuranceBroken Link

Published

Nov 25, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-40277Joplin version 2.8.8 allows an external attacker to execute …7.8
• CVE-2022-40278An issue was discovered in Samsung TizenRT through 3.0_GBM (…7.5
• CVE-2022-40279An issue was discovered in Samsung TizenRT through 3.0_GBM (…7.5
• CVE-2022-4028The Simple:Press plugin for WordPress is vulnerable to Store…5.4
• CVE-2022-40280An issue was discovered in Samsung TizenRT through 3.0_GBM (…7.5
• CVE-2022-40281An issue was discovered in Samsung TizenRT through 3.0_GBM (…7.5
• CVE-2022-40284A buffer overflow was discovered in NTFS-3G before 2022.10.3…7.8
• CVE-2022-40285Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: CVE…
• CVE-2022-40287 The application was found to be vulnerable to an authentica…9
• CVE-2022-40288 The application was vulnerable to an authenticated Stored C…9
• CVE-2022-40289 The application was vulnerable to an authenticated Stored C…9
• CVE-2022-4029The Simple:Press plugin for WordPress is vulnerable to Refle…4.7