CVE-2022-29013: Razer Sila Gaming Router command injection in command parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or interaction required, public exploit code, and very high EPSS probability make this a critical exposure for any internet-facing Razer Sila device.

What it is

The Razer Sila Gaming Router (firmware v2.0.441_api-2.0.418) fails to sanitize the 'command' parameter, allowing OS command injection. A crafted POST request can run arbitrary commands on the device, giving full control of the router.

Impact

An attacker can execute arbitrary operating system commands on the router, leading to full compromise of confidentiality, integrity and availability of the device and the network it serves.

Attack surface

Reachable over the network via a crafted POST request to the router's web interface; the CVSS vector indicates no authentication (PR:N) and no user interaction (UI:N) are required.

Exploitation

Public exploit code exists (Packet Storm and Exploit-DB references tagged Exploit), and EPSS is 0.769 with a 0.995 percentile, indicating high likelihood of exploitation; the CVE is not listed in CISA KEV.

What to do

• Apply the latest Razer Sila firmware if a fixed version is available; the record does not name a patched release, so confirm with the vendor.
• If no patch exists, restrict access to the router's web management interface to trusted networks only and disable remote/WAN administration.
• Place the router behind a firewall and block inbound access to its management ports from untrusted networks.
• Monitor vendor advisories for a firmware update and replace the device if support has ended.

Detection

• Inspect router and upstream logs for POST requests containing shell metacharacters (;, |, &&, `, $()) in the 'command' parameter.
• Alert on unexpected outbound connections or processes spawned by the router's web service.
• Review router configuration and filesystem for unauthorized changes or added accounts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.