CVE-2022-24629

critical · 9.8

An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. Remote code execution can be achieved via directory traversal in the dir parameter of the file upload functionality of BrowseFiles.php. An attacker can upload a .php file to WebAdmin/admin/AudioCodes_files/ajax/.

9.8

CVSS

37.2%

EPSS (exploit prob.)

98th

EPSS percentile

2023-05-29

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-22

Affected products

Vendor	Product	Affected versions
audiocodes	device_manager_express	<= 7.8.20002.47752

Check a specific version with /api/v1/cve/match.

References

http://seclists.org/fulldisclosure/2023/Feb/12
http://seclists.org/fulldisclosure/2023/Feb/12

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2022-24629