CVE-2022-40994 HIGH

CVE-2022-40994

Vendor Siretta
Product QUARTZ-GOLD
Weakness CWE-120
Published January 26, 2023
Last update November 4, 2025
View on NVD All CVEs

CVSS base score

7.2/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Several stack-based buffer overflow vulnerabilities exist in the DetranCLI command parsing functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted network packet can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger these vulnerabilities.This buffer overflow is in the function that manages the 'no firmwall keyword WORD description (WORD|null)' command template.

Key dates

02Disclosure timeline

January 26, 2023 CVE published
November 4, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2021-29540 Heap buffer overflow in `Conv2DBackpropFilter` CVE-2026-6630 Tenda F451 httpd GstDhcpSetSer fromGstDhcpSetSer buffer overflow CVE-2022-20893 Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Remote Command Execution and Denial of Service Vulnerabilities CVE-2022-20875 Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Remote Command Execution and Denial of Service Vulnerabilities CVE-2025-4450 D-Link DIR-619L formSetEasy_Wizard buffer overflow