# CVE-2022-36553: Hytec Inter HWL-2511-SS - RCE

> Live exploitation tracking for CVE-2022-36553 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2022-36553

## Key facts

- **Exploitation phase:** Background Noise. Continuous low-level scanning or exploitation attempts are observed, mostly opportunistic and automated.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** Hytec HWL-2511-SS
- **Weaknesses:** CWE-77 (Improper Neutralization of Special Elements used in a Command ('Command Injection'))

## Description

Hytec Inter HWL-2511-SS v1.05 and below was discovered to contain a command injection vulnerability via the component /www/cgi-bin/popen.cgi.

## CrowdSec analysis

[CVE-2022-36553](https://euvd.enisa.europa.eu/vulnerability/CVE-2022-36553) is a command injection vulnerability in Hytec Inter HWL-2511-SS, allowing remote attackers to execute arbitrary commands through a CGI component.

CrowdSec has been tracking this vulnerability and its exploits since 16th of May 2024.

According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2022-36553 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting.
Telemetry from the CrowdSec network also shows that exploitation activity for CVE-2022-36553 remains steady week-over-week. Attack volumes are consistent with long-term trends, indicating sustained interest from threat actors. CVE-2022-36553 continues to be an active part of the threat landscape and will likely remain this way for the forseeable future.

Exploitation attempts are typically directed at paths containing `/cgi-bin/popen.cgi`.

## Timeline

- 2022-08-29: CVE Published. CVE-2022-36553 is published to NVD.
- 2024-05-16: Rule Released. CrowdSec releases a rule to detect CVE-2022-36553 exploitation attempts against the CrowdSec Network.
- 2024-11-23: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2022-36553 for the first time.

## References

- https://hytec.co.jp/eng/wordpress/wp-content/uploads/2019/09/hwl-2511-ss-ds.3.0.pdf
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-36553.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2022-36553) follows observed exploitation activity for CVE-2022-36553. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.