What is CVE-2022-24629?

CVE-2022-24629 is a critical-severity vulnerability in Audiocodes Device Manager Express, classified under Path Traversal. CVSS score: 9.8/10. Published 2023-05-29.

How severe is CVE-2022-24629?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Path Traversal in Audiocodes Device Manager Express

CVE-2022-24629

An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. Remote code execution can be achieved via directory traversal in the dir parameter of the file upload functionality of BrowseFiles.php. An attacker can upload a .php file to WebAdmin/admin/AudioCodes_files/ajax/.

Vulnerability class: Path Traversal (Directory Traversal)

EPSS: 0.372 (98.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Audiocodes Device_manager_express
N/a — versions n/a

Weakness classification (CWE)

CWE-22 — Path Traversal

References

cve@mitre.org (Exploit, Mailing List, Third Party Advisory)

Frequently asked questions

What is CVE-2022-24629?: CVE-2022-24629 is a critical-severity vulnerability in Audiocodes Device Manager Express, classified under Path Traversal. CVSS score: 9.8/10. Published 2023-05-29.
How severe is CVE-2022-24629?: Critical severity. CVSS v3 base score is 9.8 out of 10.