CVE-2022-31793 is a high-severity arbitrary file read vulnerability in muhttpd versions prior to 1.1.7, affecting devices such as Arris NVG and BGW series. An unauthenticated remote attacker can exploit this flaw by crafting a malicious URL, allowing them to read sensitive files from the affected device's filesystem. With a CVSS score of 7.5 and an EPSS score indicating high exploitability, this vulnerability presents a significant risk. While no active exploitation is confirmed and no Metasploit modules exist, Nuclei templates are available, suggesting potential for exploitation. Community discussion and media coverage are currently low.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.1.7CPE matchmatch criteria | cpe:2.3:a:inglorion:muhttpd:*:*:*:*:*:*:*:* | ||
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:o:arris:nvg443_firmware:-:*:*:*:*:*:*:* | ||
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:o:arris:nvg599_firmware:-:*:*:*:*:*:*:* | ||
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:o:arris:nvg589_firmware:-:*:*:*:*:*:*:* | ||
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:o:arris:nvg510_firmware:-:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.