CVE-2022-44149

What it actually does

This is an authenticated command injection vulnerability in the Nexxt Amp300 web management service. The ping diagnostic function in the goform/sysTools component accepts a JSON host value and fails to safely validate or quote it before passing it to the underlying operating system. A low-privileged authenticated attacker can inject shell metacharacters, such as placing &telnetd in the host field, causing the device to execute unintended OS commands. Successful exploitation can provide command execution with the privileges of the web service process, potentially enabling device takeover, configuration manipulation, credential theft, traffic interception, persistence, or denial of service.

Why it matters to the business

Compromise of an affected network device can give an attacker control over routing or access-point infrastructure, allowing disruption of connectivity, interception or redirection of traffic, pivoting into internal networks, and persistence at the network edge. The CVSS score is high and public exploit information is available, with a high EPSS score indicating meaningful exploitation likelihood. Although it is not currently listed in CISA KEV and is not flagged as ransomware-associated, exposed administrative interfaces should be treated as urgent because network appliances are commonly abused for botnets, proxying, and internal reconnaissance. The supplied package metadata also lists WordPress/Debian fixed versions, but those appear inconsistent with the Nexxt device description; organizations should verify the authoritative vendor advisory for this CVE before applying software-package assumptions.

How an attack unfolds

An attacker first obtains valid credentials for the device web interface or reuses default, weak, or previously compromised credentials. The attacker then sends a crafted request to the ping tool exposed by the goform/sysTools component. Instead of submitting only a hostname or IP address, the attacker places shell control characters and a command in the JSON host field, such as a value that appends telnetd. Because the web service passes this field to an OS command without proper sanitization, the injected command is interpreted by the device shell. In the documented case, the attacker can start a telnet daemon, then connect to the newly exposed telnet service and run additional commands. From there, the attacker may change configuration, add persistence, download tooling, join the device to a botnet, scan internal networks, or disrupt service.

How to fix it

Upgrade affected Nexxt Amp300 ARN02304U8 devices running firmware 42.103.1.5095 or 80.103.2.5045 to a vendor-provided fixed firmware release if available. If no fixed firmware is available, replace the device or remove exposure of the administrative interface from untrusted networks. Disable remote administration from the internet, restrict management access to a dedicated trusted network or VPN, and enforce strong unique administrative credentials. Disable telnet and prefer SSH or HTTPS management where supported. Block inbound access to device management ports from untrusted networks and monitor for unexpected TCP/23 exposure. Review the supplied fixed-version metadata carefully because it references WordPress packages rather than the Nexxt device described by this CVE; if those packages are in scope for a separate advisory, the listed fixed versions are: wordpress/wordpress fixed at commit 1015e926e9dd093fd57abbf0cb38c2ead1b18606, wordpress/wordpress-develop fixed at commit 756915de8c5dbe6c9b210299ec8ce8d524f9dfaf, Debian 11 wordpress fixed in 5.7.8+dfsg1-0+deb11u1, and Debian 12/13 wordpress fixed in 6.0.3+dfsg1-1.

How to confirm the fix worked

Confirm device inventory for Nexxt Amp300 ARN02304U8 and verify firmware versions through the administrative UI, CLI, or configuration backup. Devices running 42.103.1.5095 or 80.103.2.5045 should be considered vulnerable unless the vendor confirms otherwise. Validate that the management interface is not reachable from the internet or untrusted networks. Confirm telnet is disabled and TCP port 23 is not listening unless explicitly required. Review web access logs or network captures for POST requests to /goform/sysTools that include suspicious host values containing shell metacharacters. After remediation, retest the ping function with benign input and verify that metacharacters are rejected or treated as literal data rather than executed. For the inconsistent WordPress package metadata, validate installed package versions only if an authoritative source confirms those products are actually affected by the same issue.

Typical attack path

1. Identify an exposed Nexxt Amp300 management interface or gain network reachability to the administrative service.
2. Authenticate using valid, default, weak, reused, or stolen device credentials.
3. Access the ping diagnostic function handled by goform/sysTools.
4. Submit a crafted JSON request where the host field contains shell metacharacters and an OS command, such as invoking telnetd.
5. Trigger command execution on the embedded operating system under the web service context.
6. Connect to any newly opened management service, such as telnet on TCP port 23, or run follow-on commands through the injection point.
7. Perform post-exploitation actions such as configuration changes, credential extraction, traffic redirection, internal scanning, persistence, or denial of service.

How to detect it

Look for evidence of suspicious use of the device ping diagnostic feature and follow-on telnet access. Useful sources include web management access logs, reverse proxy logs if the interface is proxied, firewall logs, NetFlow, IDS/IPS alerts, configuration backups, process listings from the device if available, and authentication logs. Search for HTTP POST requests to /goform/sysTools, especially where the JSON host field contains shell metacharacters such as &, ;, |, backticks, $(), or encoded equivalents. The most directly associated indicator is an attempt to place &telnetd in the host field. After suspected exploitation, check whether TCP port 23 became reachable, whether a telnetd process is running, whether new administrative sessions occurred, whether DNS or routing settings changed, and whether the device initiated unusual outbound connections or internal scans. Because the vulnerability requires authentication, correlate suspicious requests with login events, failed login bursts, use of default credentials, access from unfamiliar IP addresses, and management actions from unusual geographies or networks.

• POST /goform/sysTools
• /goform/sysTools
• "host":"&telnetd"
• "host": "&telnetd"
• %26telnetd
• &telnetd
• telnetd
• busybox telnetd
• TCP/23
• "host":";
• "host":"|
• "host":"`
• "host":"$(

What your security team should do

• Prioritize inventory of Nexxt Amp300 ARN02304U8 devices and identify any running firmware 42.103.1.5095 or 80.103.2.5045.
• Immediately remove internet exposure for device administration interfaces and restrict management access to trusted networks or VPN-only access.
• Patch or replace affected devices; if no vendor fix exists, plan device retirement because command injection in network-edge equipment is difficult to safely mitigate long term.
• Rotate device administrative credentials and eliminate default or reused passwords.
• Disable telnet and verify TCP/23 is not exposed internally or externally unless explicitly approved.
• Hunt for requests to /goform/sysTools with suspicious JSON host values, especially values containing &telnetd or shell metacharacters.
• Review network telemetry for new or unexpected telnet sessions, outbound scanning, DNS changes, routing changes, or traffic redirection from affected devices.
• Treat public exploit availability and high EPSS as a reason for accelerated remediation even though the vulnerability is not currently in CISA KEV.