Skip to content
Fencer Vulns
high 8.8

CVE-2022-27226 in the critical feed json

A CSRF issue in /api/crontab on iRZ Mobile Routers through 2022-03-16 allows a threat actor to create a crontab entry in the router adminis…

published 2022-03-19 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-31735

cvss
8.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
33.7%
EPSS 33.7% chance of exploitation in 30 days, percentile 98%
public exploits
1
Exploit-DB

Summary

A CSRF issue in /api/crontab on iRZ Mobile Routers through 2022-03-16 allows a threat actor to create a crontab entry in the router administration panel. The cronjob will consequently execute the entry on the threat actor's defined interval, leading to remote code execution, allowing the threat actor to gain filesystem access. In addition, if the router's default credentials aren't rotated or a threat actor discovers valid credentials, remote code execution can be achieved without user interaction.

Timeline

  1. Published
  2. First public exploit (EDB-50832)

Exploit prediction

33.70% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • EDB-50832 iRZ Mobile Router - CSRF to RCE remote, 2022-03-22
  • johnjhacking.com https://johnjhacking.com/blog/cve-2022-27226/ referenced PoC, tagged "exploit" by a source, unverified
  • github.com https://github.com/SakuraSamuraii/ez-iRZ referenced PoC, tagged "exploit" by a source, unverified
  • packetstormsecurity.com http://packetstormsecurity.com/files/166396/iRZ-Mobile-Router-Cross-Site-Request-Forgery-Remote-Code-Execution.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD 2.0 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C

Classification

Weakness
  • CWE-352 Cross-Site Request Forgery

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.