CVE-2022-36779

CRITICAL

PROSCEND - PROSCEND / ADVICE .Ltd - G/5G Industrial Cellular Router (with GPS)4 Unauthenticated OS Command Injection Proscend M330-w / M33-W5 / M350-5G / M350-W5G / M350-6 / M350-W6 / M301-G / M301...

Affects 18 products across 2 vendors.

CVSS 3.19.8
EPSS2.9%
Percentile87th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-78: OS Command Injection

Attacker injects OS commands through application inputs passed to system() or equivalent calls, leading to arbitrary command execution.

Related Attack Patterns (CAPEC)
CAPEC-43 Exploiting Multiple Input Interpretation Layers
via CWE-78
CAPEC-108 Command Line Execution through SQL Injection
via CWE-78
CAPEC-6 Argument Injection
via CWE-78
CAPEC-15 Command Delimiters
via CWE-78
CAPEC-88 OS Command Injection
via CWE-78

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

A critical vulnerability exists in the PROSCEND / ADVICE .Ltd G/5G Industrial Cellular Router (with GPS)4, allowing unauthenticated OS command injection. This could lead to full control of the device, potentially compromising industrial operations.

BSID: BS-2022-GLOBAL-255218-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2022-36779?
A critical vulnerability exists in the PROSCEND / ADVICE .Ltd G/5G Industrial Cellular Router (with GPS)4, allowing unauthenticated OS command injection. This could lead to full control of the device, potentially compromising industrial operations.
What is the CVSS score for CVE-2022-36779?
CVE-2022-36779 has CVSS 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS: 2.9%.
Is CVE-2022-36779 actively exploited?
No confirmed active exploitation of CVE-2022-36779 as of 2026-09-25.
How do I remediate CVE-2022-36779?
Priority: IMMEDIATE.
What systems are affected by CVE-2022-36779?
CVE-2022-36779 affects Advice Icr 111Wg; Proscend M330-W5, M350-5G, M350-W5G, M350-W6, M301-G, M301-Gw, M350-6, M330-W.
Vulnerability Details
CVE IDCVE-2022-36779
BSIDBS-2022-GLOBAL-255218-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published2022-09-13
Last Modified2026-06-17
ICS Relevance25%
Weakness (CWE)
OS Command Injection
SourceNVD
Official Description

PROSCEND - PROSCEND / ADVICE .Ltd - G/5G Industrial Cellular Router (with GPS)4 Unauthenticated OS Command Injection Proscend M330-w / M33-W5 / M350-5G / M350-W5G / M350-6 / M350-W6 / M301-G / M301-GW ADVICE ICR 111WG / https://www.proscend.com/en/category/industrial-Cellular-Router/industrial-Cellular-Router.html https://cdn.shopify.com/s/files/1/0036/9413/3297/files/ADVICE_Industrial_4G_LTE_Cellular_Router_ICR111WG.pdf?v=1620814301

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

An attacker can exploit this vulnerability by sending specially crafted HTTP requests to the router's web interface without any authentication. This allows the execution of arbitrary OS commands on the device.

Exploitation Likelihood: CRITICAL

Affected Products
VendorProductAffected Versions
Advice Icr 111Wg (device & firmware) < 1.11
Proscend M330-W5 (device & firmware) < 1.11
Proscend M350-5G (device & firmware) < 1.02
Proscend M350-W5G (device & firmware) < 1.02
Proscend M350-W6 (device & firmware) < 1.02
Proscend M301-G (device & firmware) < 2.20
Proscend M301-Gw (device & firmware) < 2.20
Proscend M350-6 (device & firmware) < 1.02
Proscend M330-W (device & firmware) < 1.11
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 1493 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hash961140a27ef56514b4cf3abf3db5aaa49981394233b6eeeb47de34705e7a834499b7bc5603c906dbe14a81afed21b9676507a084385511ab8efcc89692e5cbd6
Related CVEs affecting Advice
CVE-2024-8672 9.9 The Widget Options – The #1 WordPress Widget & Block Control Plugin plugin fo... CVE-2018-25288 6.2 StyleWriter 1.0 contains a buffer overflow vulnerability that allows local at...
View all Advice CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →