by Kastro
Paper/Archive/CVE-2022-23764

CVE-2022-23764

TERUTEN Co.,Ltd WebCube — TERUTEN WebCube update remote code execution vulnerability

EPSS 0.7%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 51.8.518 × 2010.4No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

The vulnerability causing from insufficient verification procedures for downloaded files during WebCube update. Remote attackers can bypass this verification logic to update both digitally signed and unauthorized files, enabling remote code execution.

Affected

ProductAffectedFixed inSource
WebCube1.0.5.5 – < 1.2.0.01.2.0.0CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
krcert (CNA)8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

refkrcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66876