CVE-2022-33128
📋 TL;DR
This CVE describes a SQL injection vulnerability in the RG-EG series gateway's alarmService.php function, allowing attackers to execute arbitrary SQL commands. It affects RG-EG gateway models EG350 running EG_RGOS version 11.1(6), potentially compromising network security.
💻 Affected Systems
- RG-EG series gateway EG350
📦 What is this software?
Rg Eg350 Firmware by Ruijienetworks
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise, data theft, or network takeover via SQL injection leading to remote code execution or administrative access.
Likely Case
Unauthorized data access, manipulation of alarm systems, or gateway configuration changes.
If Mitigated
Limited impact if input validation and network segmentation are enforced, preventing exploitation.
🎯 Exploit Status
Exploitation is straightforward via crafted HTTP requests to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: No official vendor advisory found in provided references.
Restart Required: No
Instructions:
Check vendor website for updates or patches; if unavailable, apply workarounds.
🔧 Temporary Workarounds
Block Access to Vulnerable Endpoint
linuxRestrict network access to /alarm_pi/alarmService.php using firewall rules.
iptables -A INPUT -p tcp --dport 80 -m string --string '/alarm_pi/alarmService.php' --algo bm -j DROP
Input Validation via WAF
allDeploy a web application firewall to filter SQL injection attempts.
🧯 If You Can't Patch
- Isolate the gateway in a segmented network to limit exposure.
- Monitor logs for unusual access patterns to the vulnerable endpoint.
🔍 How to Verify
Check if Vulnerable:
Send a crafted SQL injection payload to http://<gateway-ip>/alarm_pi/alarmService.php and check for error responses or unexpected behavior.Check Version:
ssh admin@<gateway-ip> show version | grep EG_RGOSVerify Fix Applied:
After applying workarounds, test the endpoint to ensure it no longer processes malicious inputs.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in gateway logs
- Multiple failed login attempts or access to alarmService.php
Network Indicators:
- HTTP requests with SQL keywords to the vulnerable endpoint
SIEM Query:
source="gateway_logs" AND (url="/alarm_pi/alarmService.php" AND (payload CONTAINS "' OR" OR payload CONTAINS "--"))