CVE-2022-28944

Common vulnerabilities & exposures (CVE)

CVE database CVE database blogpost Release & EoL database

Published at: - 23-05-2022 08:16

Last modified: - 07-06-2022 05:08

Total changes: - 2

Description

Certain EMCO Software products are affected by: CWE-494: Download of Code Without Integrity Check. This affects MSI Package Builder for Windows 9.1.4 and Remote Installer for Windows 6.0.13 and Ping Monitor for Windows 8.0.18 and Remote Shutdown for Windows 7.2.2 and WakeOnLan 2.0.8 and Network Inventory for Windows 5.8.22 and Network Software Scanner for Windows 2.0.8 and UnLock IT for Windows 6.1.1. The impact is: execute arbitrary code (remote). The component is: Updater. The attack vector is: To exploit this vulnerability, a user must trigger an update of an affected installation of EMCO Software. ¶¶ Multiple products from EMCO Software are affected by a remote code execution vulnerability during the update process.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Low

Attack complexity

Network

Attack vector

High

Availability

High

Confidentiality

High

Integrity

None

Privileges required

Unchanged

Scope

Required

User interaction

8.8

Base score

2.8

5.9

Exploitability score

Impact score

Verification logic

AND

vendor=emcosoftware AND product=network_inventory AND version=5.8.22

vendor=emcosoftware AND product=network_software_scanner AND version=2.0.8

vendor=emcosoftware AND product=unlock_it AND version=6.1.1

vendor=emcosoftware AND product=remote_shutdown AND version=7.2.2

vendor=emcosoftware AND product=ping_monitor AND version=8.0.18

vendor=emcosoftware AND product=msi_package_builder AND version=9.1.4

vendor=emcosoftware AND product=remote_installer AND version=6.0.13

vendor=microsoft AND product=windows AND version=-

vendor=emcosoftware AND product=wakeonlan AND version=2.0.8 AND software_edition=professional

vendor=emcosoftware AND product=wakeonlan AND version=2.0.8 AND software_edition=free

Reference

Keywords

CVE-2022-28944

Common vulnerabilities & exposures (CVE)

Description

Common Vulnerability Scoring System (CVSS)

Verification logic

Reference

NVD

CVE-2022-28944

CVE

Common vulnerabilities & exposures

CVSS

Common vulnerability scoring system

Security

Vulnerabilities

Exposures