CVE-2022-3086

highpriority · track · 30EPSS 0.003 · 24 %ileEURUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.32% (24th) EPSS

CVSS 7.6 · high

Is it mine?

69 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_ot

EPSS · scored 2026-10-27

Cradlepoint IBR600 NCOS versions 6.5.0.160bc2e and prior are vulnerable to shell escape, which enables local attackers with non-superuser credentials to gain full, unrestrictive shell access which may allow an attacker to execute arbitrary code.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

No vendor fix yet; a mitigation is available.

MitigationCradlepoint IBR600 NetCloud OS (NCOS)cisa_csaf_ot
Cradlepoint recommends users to update to at least version: NCOS v7.22.70

cvss

Technical severity, 0–10. One row per scoring source.

8.4

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.17.6highCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 0.9 · impact 6

v3.07.1highCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Nsecondary · CISA US

v3.18.4highAV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.17.1highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Nsecondary · ENISA EU

v3.17.1highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Nsecondary · ics-cert@hq.dhs.gov USexploitability 1.8 · impact 5.2

v3.17highCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-1263USCWE-77USCWE-77USCWE-77US

affected products (69)

Products and version ranges known to be affected.

IBR600 - Cradlepoint IBR600 NetCloud OS (NCOS) Version: 6.5.0.160bc2e and priorall versionscisa_csaf_otUS
Cradlepoint Cradlepoint IBR600 NetCloud OS (NCOS)≤ 6.5.0.160bc2ecisa_csaf_otUS
Cradlepoint IBR600≤ 0 ≤6.5.0.160bc2eenisa_euvdEU
Cradlepoint NetCloud OS≤ 7.22.70fstec_bduRU
Moxa Inc. UC-2100 Series1.3 → 1.5fstec_bduRU
Moxa Inc. UC-2100-W Series1.3 → 1.5fstec_bduRU
Moxa Inc. UC-3100 Series1.2 → 2.0fstec_bduRU
Moxa Inc. UC-5100 Series≤ 1.2fstec_bduRU
Moxa Inc. UC-8100 Series≤ 1.2fstec_bduRU
Moxa Inc. UC-8100A-ME-T Series1.0 → 1.1fstec_bduRU
Moxa Inc. UC-8200 Series1.0 → 2.4fstec_bduRU
Moxa Inc. UC-8410A Series≤ 2.2fstec_bduRU
Moxa Inc. UC-8540 Series1.0 → 1.2fstec_bduRU
Moxa Inc. UC-8580 Series≤ 1.1fstec_bduRU
moxa uc-2101-lx firmware1.3 → 1.5nvdUScpe:2.3:o:moxa:uc-2101-lx_firmware:*:*:*:*:*:*:*:*
moxa uc-2102-lx firmware1.3 → 1.5nvdUScpe:2.3:o:moxa:uc-2102-lx_firmware:*:*:*:*:*:*:*:*
moxa uc-2104-lx firmware1.3 → 1.5nvdUScpe:2.3:o:moxa:uc-2104-lx_firmware:*:*:*:*:*:*:*:*
moxa uc-2111-lx firmware1.3 → 1.5nvdUScpe:2.3:o:moxa:uc-2111-lx_firmware:*:*:*:*:*:*:*:*
moxa uc-2112-lx firmware1.3 → 1.5nvdUScpe:2.3:o:moxa:uc-2112-lx_firmware:*:*:*:*:*:*:*:*
moxa uc-2114-t-lx firmware1.3 → 1.5nvdUScpe:2.3:o:moxa:uc-2114-t-lx_firmware:*:*:*:*:*:*:*:*

showing 20 of 69

advisories (1)

Vendor and ecosystem advisories describing this.

ICSA-22-321-02Cradlepoint IBR6002022-11-17icsa · cisa_csaf_otUS
Successful exploitation of this vulnerability could allow an attacker to execute code and native system commands.

also known as (6)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cisa_csaf_ot nvd NVD CVE.org MITRE

published 2022-12-02modified 2026-06-17

references (8)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan