CVE-2022-44149: Nexxt Amp300 router ping feature OS command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityCVSS 8.8 with public exploit code and very high EPSS (99.2nd percentile) make this a high-priority patching target despite requiring authentication.

What it is

The goform/sysTools ping feature on Nexxt Amp300 ARN02304U8 firmware versions 42.103.1.5095 and 80.103.2.5045 fails to sanitize the JSON host field, allowing an authenticated remote user to inject OS commands via a &telnetd payload. Successful exploitation gives full command execution on the router, which is a high-impact network device.

Impact

An attacker with valid credentials gains remote OS command execution on the device, enabling arbitrary command execution, configuration changes, and potential lateral movement into the internal network.

Attack surface

Reachable over the network through the router's web management interface (goform/sysTools ping feature); authentication is required and no user interaction is needed per the CVSS vector (AV:N/AC:L/PR:L/UI:N).

Exploitation

Public exploit code is referenced in Packet Storm and CXSecurity advisories, and EPSS is 0.64354 (99.2nd percentile), indicating a high likelihood of exploitation; the CVE is not listed in CISA KEV.

What to do

• Apply the latest firmware from Nexxt Solutions for the Amp300 ARN02304U8; if no fixed version is available, isolate or replace the device.
• Restrict management interface access to trusted networks and disable remote WAN administration.
• Change default and weak administrative credentials and enforce strong unique passwords.
• Monitor and block outbound telnet (TCP 23) from router management segments.
• Segment IoT/router management traffic from production networks.

Detection

• Alert on HTTP POST requests to goform/sysTools containing shell metacharacters such as &, ;, |, or telnetd in the host field.
• Monitor for unexpected telnetd processes or outbound TCP 23 connections originating from the router.
• Review router authentication logs for anomalous or unexpected administrative logins preceding command execution.
• Use network IDS signatures for known Nexxt Amp300 RCE exploit traffic.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.