CVE-2022-32765 is an OS command injection vulnerability (CWE-78) in the sysupgrade firmware-upload function of the Robustel R1510 industrial cellular VPN router: an attacker who can reach the device's firmware-upload API can send a specially crafted upgrade file that is passed unsanitized into a shell command, executing arbitrary operating system commands with root privileges; NVD's own analysis rates the flaw 9.8 (critical) on CVSS v3.1, while Cisco Talos — the researchers who discovered it — scored it 9.1 using the older CVSS v3.0 standard and a different attack-complexity assessment.
Vulnerability summary
9.8
Critical
3.7%
EPSS score (FIRST)
No
CISA KEV catalog
2022-10-25
Published
Vulnerability ID: CVE-2022-32765 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Robustel R1510 Industrial Cellular VPN Router firmware (sysupgrade firmware-update function) | — | Firmware 3.1.16 and 3.3.0 confirmed vulnerable by Cisco Talos and the vendor; Robustel released a patch on 2022-09-27 per the Talos advisory timeline (the resulting fixed firmware version number is not published in the Talos report or recorded by NVD) |
What does this mean for affected devices?
CVE-2022-32765 (CWE-78, OS command injection) affects the sysupgrade firmware-update function of the Robustel R1510, described by Robustel as an "industrial cellular VPN router" offering "an innovative use of Open VPN, Cloud management, data over-use guard, smart reboot and others." NVD's description states: "An OS command injection vulnerability exists in the sysupgrade command injection functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network request can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger this vulnerability" (NVD).
Cisco Talos' report TALOS-2022-1576 explains the root cause in detail: the R1510 offers the admin user the ability to upgrade firmware through a specific API, which calls a sysupgrade binary; a precisely crafted upgrade file reaches code that builds a file path from the attacker-controlled upgrade_obj.file_desc field and passes it, unsanitized, into a sysprintf-formatted shell command executed via system() — because that field is "not checked against command injections," arbitrary commands can be injected. Talos rates the flaw CWE-77 and CVSS v3.0 9.1 (critical), vector CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H — requiring high privileges (PR:H) to reach the upgrade API — while NVD's own Primary CVSS v3.1 rating of 9.8 uses vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, requiring no privileges (PR:N) at all; this page shows NVD's Primary score as the headline figure and notes the vendor-side researcher assessment separately rather than conflating the two (NVD).
Talos' disclosure timeline records vendor disclosure on 2022-07-13, a vendor patch release on 2022-09-27, and public release of the report on 2022-10-14; the flaw was discovered by Francesco Benvenuto of Cisco Talos as one of ten vulnerabilities Talos found in the R1510 in the same research round, nine of them command-injection issues rated critical (Cisco Talos Vulnerability Report TALOS-2022-1576).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.03704 (89.8th percentile) as of 2026-11-08 — notably higher than most vulnerabilities this old, consistent with the device class (internet-facing industrial cellular routers) remaining a scanning target years after disclosure (CISA KEV, FIRST EPSS).
Operators of Robustel R1510 routers still running firmware 3.1.16 or 3.3.0 should apply Robustel's 2022 firmware update and restrict access to the device's web and firmware-upgrade interfaces to trusted management networks, since the vulnerability was one of several affecting the same upgrade pathway.
Evidence
- An OS command injection vulnerability exists in the sysupgrade command injection functionality of Robustel R1510 3.1.16 and 3.3.0; a specially-crafted network request can lead to arbitrary command execution via a sequence of requests. — NVD
- Root cause: the sysupgrade binary builds a shell command path from the attacker-controlled upgrade_obj.file_desc field without checking it for command injection, then passes it to system(); CWE-77; CVSS v3.0 9.1, vector CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H; discovered by Francesco Benvenuto; vendor disclosure 2022-07-13, vendor patch 2022-09-27, public release 2022-10-14. — Cisco Talos Vulnerability Report TALOS-2022-1576
- NVD's own Primary CVSS v3.1 score is 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, classified CWE-78 — a higher score and a no-privileges-required attack vector compared to Talos' vendor-side PR:H assessment. — NVD
- Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.03704 (89.8th percentile) as of 2026-11-08. — FIRST EPSS
Questions about this page?
Related advisories
Sources
Frequently asked questions
Does exploiting CVE-2022-32765 require privileged access first?
Sources disagree: NVD's own Primary CVSS v3.1 rating assumes no privileges are required (PR:N) and scores the flaw 9.8, while Cisco Talos — the researchers who discovered it — scored it 9.1 under CVSS v3.0 assuming high privileges are needed to reach the firmware-upgrade API (PR:H) (per NVD; per Cisco Talos Vulnerability Report TALOS-2022-1576).
How does the command injection actually work?
The router's sysupgrade binary builds a shell command path from the attacker-controlled upgrade_obj.file_desc field in a crafted firmware-upgrade file, without checking it for injection, then passes it unsanitized into a system() call that executes with root privileges (per Cisco Talos Vulnerability Report TALOS-2022-1576).
Was this the only vulnerability found in the Robustel R1510?
No — Cisco Talos discovered ten vulnerabilities in the R1510 in the same research round, nine of them command-injection issues rated critical, of which CVE-2022-32765 is one (per Cisco Talos Vulnerability Report TALOS-2022-1576).
Has Robustel released a fix, and is the device still being targeted?
Yes, Talos' disclosure timeline records a vendor patch released 2022-09-27, but FIRST's EPSS score of 0.03704 (89.8th percentile as of 2026-11-08) is notably high for a multi-year-old flaw, consistent with internet-facing industrial cellular routers remaining an active scanning target (per Cisco Talos Vulnerability Report TALOS-2022-1576; per FIRST EPSS).