Skip to content
CVE PROGRAM SOURCE RECORD9.6 Critical

CVE-2022-26941

Format string vulnerability in AT+CTGL command in Motorola MTM5000

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
NCSC-NL

Description

A format string vulnerability exists in Motorola MTM5000 series firmware AT command handler for the AT+CTGL command. An attacker-controllable string is improperly handled, allowing for a write-anything-anywhere scenario. This can be leveraged to obtain arbitrary code execution inside the teds_app binary, which runs with root privileges.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Motorola Mobile Radio

  • MTM5000affected

References