What’s Vulnerable › Vulnerabilities
CVE-2022-27226
- Severity: high (CVSS 8.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 33.7% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2022-03-19 · updated 2026-06-17
- Weakness: CWE-352
Description
A CSRF issue in /api/crontab on iRZ Mobile Routers through 2022-03-16 allows a threat actor to create a crontab entry in the router administration panel. The cronjob will consequently execute the entry on the threat actor's defined interval, leading to remote code execution, allowing the threat actor to gain filesystem access. In addition, if the router's default credentials aren't rotated or a threat actor discovers valid credentials, remote code execution can be achieved without user interaction.
Affected products
- Irz Rl01 Firmware: through 2022-03-16
- Irz Rl21 Firmware: through 2022-03-16
- Irz Ru21 Firmware: through 2022-03-16
- Irz Ru21W Firmware: through 2022-03-16
- Irz Ru41 Firmware: through 2022-03-16
References
- http://packetstormsecurity.com/files/166396/iRZ-Mobile-Router-Cross-Site-Request-Forgery-Remote-Code-Execution.html
- https://en.irz.ru
- https://github.com/SakuraSamuraii/ez-iRZ
- https://johnjhacking.com/blog/cve-2022-27226/
- http://packetstormsecurity.com/files/166396/iRZ-Mobile-Router-Cross-Site-Request-Forgery-Remote-Code-Execution.html
- https://en.irz.ru
- https://github.com/SakuraSamuraii/ez-iRZ
- https://johnjhacking.com/blog/cve-2022-27226/
Get alerted when CVE-2022-27226 or the next vulnerability affects your stack