Vulnerability · Published Jan 3, 2023 · Assigned by twcert
CVE-2022-46304ChangingTec ServiSign - Command Injection
High 8.8
In plain English
A high-severity OS command injection in ServiSign from ChangingTec. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 75% of all known vulnerabilities).
Official description
ChangingTec ServiSign component has insufficient filtering for special characters in the connection response parameter. An unauthenticated remote attacker can host a malicious website for the component user to access, which triggers command injection and allows the attacker to execute arbitrary system command to perform arbitrary system operation or disrupt service.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ChangingTec | ServiSign | see references |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H