CVE-2022-36553: Hytec HWL-2511-SS popen.cgi command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityUnauthenticated network-reachable command injection with a 9.8 CVSS score and very high EPSS probability, though no confirmed in-the-wild exploitation is recorded.

What it is

Hytec Inter HWL-2511-SS firmware v1.05 and below contains a command injection flaw in the /www/cgi-bin/popen.cgi component. Because the endpoint is network-reachable and requires no authentication or user interaction, an unauthenticated attacker can execute arbitrary commands on the device. The CVSS 3.1 base score is 9.8 (critical).

Impact

An attacker gains arbitrary command execution with the privileges of the CGI process, allowing full compromise of confidentiality, integrity and availability of the device. This can be used to pivot into the network the device sits on.

Attack surface

Reached over the network via the HTTP-exposed /www/cgi-bin/popen.cgi endpoint; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no user interaction are required.

Exploitation

Not listed in CISA KEV and no ransomware association is recorded, but EPSS is very high (0.909 probability, 99.8th percentile), indicating elevated likelihood of exploitation. The only public reference is a broken link, so no working exploit is confirmed in this record.

What to do

• Apply the vendor firmware update for HWL-2511-SS; check the Hytec product and advisory pages for the fixed release.
• If no patch is available, isolate the device on a dedicated management VLAN and block access to /www/cgi-bin/ from untrusted networks.
• Disable or restrict remote web management and place the device behind a firewall with allowlisted source addresses only.
• Monitor the vendor advisory page for updated firmware and remediation guidance.
• Replace end-of-support units that cannot be patched.

Detection

• Inspect web server and device logs for requests to /www/cgi-bin/popen.cgi, especially with shell metacharacters in parameters.
• Alert on unexpected outbound connections or new processes spawned by the CGI/web service on the device.
• Watch for command-injection patterns (;, |, $(), backticks) in HTTP requests to the device's management interface.
• Baseline normal traffic to the device and flag anomalous POST/GET requests to CGI endpoints from unfamiliar hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.