Paper/Archive/CVE-2022-30534

CVE-2022-30534

WWBN AVideo — An OS command injection vulnerability exists in the aVideoEncoder chunkfile functionality of WWBN AVideo 11.6 and dev master commit 3f7c0…

EPSS 75%CVSS 9.9

critical.is priorityof 100

CVSS 9.9 (CNA)9.9 / 10 × 3029.7 Not in CISA KEV+300.0 EPSS percentile 99.5.995 × 2019.9 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

An OS command injection vulnerability exists in the aVideoEncoder chunkfile functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can send an HTTP request to trigger this vulnerability.

Affected

ProductAffectedFixed inSource

AVideo11.6–CNA

AVideodev master commit 3f7c0364–CNA

Scores by source

talos (CNA)9.9CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgithub.com/WWBN/AVideo/blob/e04b1cd7062e16564157a82bae389eedd39fa088/updatedb/updateDb.v12.0.sql reftalosintelligence.com/vulnerability_reports/TALOS-2022-1546