CVE:CVE-2022-27226
CNNVD:CNNVD-202203-1871
iRZ Mobile Routers是俄罗斯iRZ公司的一系列移动路由器。
iRZ Mobile Routers 的 /api/crontab 中存在安全漏洞，攻击者可利用该漏洞在路由器管理面板中创建 crontab 条目，cronjob将在攻击者定义的时间间隔内执行条目，从而导致远程代码执行，从而获得文件系统访问权限。
solution:Upgrade irz ru21_firmware to a higher version than 2022-03-16,and avoid the version (,2022-03-16]; Upgrade irz ru21w_firmware to a higher version than 2022-03-16,and avoid the version (,2022-03-16]; Upgrade irz rl21_firmware to a higher version than 2022-03-16,and avoid the version (,2022-03-16]; Upgrade irz ru41_firmware to a higher version than 2022-03-16,and avoid the version (,2022-03-16]; Upgrade irz rl01_firmware to a higher version than 2022-03-16,and avoid the version (,2022-03-16]