CVE-2022-36779: PROSCEND - PROSCEND / ADVICE .Ltd - G/5G Industrial Cellular Router (with GPS)4 Unauthenticated OS Command Injection

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-09-13 · updated 2026-06-17
Weakness: CWE-78

Description

PROSCEND - PROSCEND / ADVICE .Ltd - G/5G Industrial Cellular Router (with GPS)4 Unauthenticated OS Command Injection Proscend M330-w / M33-W5 / M350-5G / M350-W5G / M350-6 / M350-W6 / M301-G / M301-GW ADVICE ICR 111WG / https://www.proscend.com/en/category/industrial-Cellular-Router/industrial-Cellular-Router.html https://cdn.shopify.com/s/files/1/0036/9413/3297/files/ADVICE_Industrial_4G_LTE_Cellular_Router_ICR111WG.pdf?v=1620814301

Affected products

Advice Icr 111Wg Firmware: before 1.11 — fixed in 1.11
PROSCEND M301-G Firmware: before 2.20 — fixed in 2.20
PROSCEND M301-Gw Firmware: before 2.20 — fixed in 2.20
PROSCEND M330-W5 Firmware: before 1.11 — fixed in 1.11
PROSCEND M330-W Firmware: before 1.11 — fixed in 1.11
PROSCEND M350-5G Firmware: before 1.02 — fixed in 1.02
PROSCEND M350-6 Firmware: before 1.02 — fixed in 1.02
PROSCEND M350-W5G Firmware: before 1.02 — fixed in 1.02
PROSCEND M350-W6 Firmware: before 1.02 — fixed in 1.02

How to fix

Upgrade to a fixed version: Advice Icr 111Wg Firmware 1.11; PROSCEND M301-G Firmware 2.20; PROSCEND M301-Gw Firmware 2.20; PROSCEND M330-W5 Firmware 1.11; PROSCEND M330-W Firmware 1.11; PROSCEND M350-5G Firmware 1.02; PROSCEND M350-6 Firmware 1.02; PROSCEND M350-W5G Firmware 1.02; PROSCEND M350-W6 Firmware 1.02. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-36779 or the next vulnerability affects your stack