Vulnerability in Emcosoftware Msi Package Builder
CVE-2022-28944
Certain EMCO Software products are affected by: CWE-494: Download of Code Without Integrity Check. This affects MSI Package Builder for Windows 9.1.4 and Remote Installer for Windows 6.0.13 and Ping Monitor for Windows 8.0.18 and Remote Shutdown for Windows 7.2.2 and WakeOnLan 2.0.8 and Network Inventory for Windows 5.8.22 and Network Software Scanner for Windows 2.0.8 and UnLock IT for Windows 6.1.1. The impact is: execute arbitrary code (remote). The component is: Updater. The attack vector is: To exploit this vulnerability, a user must trigger an update of an affected installation of EMCO Software. ¶¶ Multiple products from EMCO Software are affected by a remote code execution vulnerability during the update process.
EPSS: 0.015 (71.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Emcosoftware Msi_package_builder — versions 9.1.4
- Emcosoftware Network_inventory — versions 5.8.22
- Emcosoftware Network_software_scanner — versions 2.0.8
- Emcosoftware Ping_monitor — versions 8.0.18
- Emcosoftware Remote_installer — versions 6.0.13
- Emcosoftware Remote_shutdown — versions 7.2.2
- Emcosoftware Unlock_it — versions 6.1.1
- Emcosoftware Wakeonlan — versions 2.0.8
- Microsoft Windows
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- af854a3a-2127-422b-91ae-364da2661108 (x_refsource_MISC, Not Applicable)
- af854a3a-2127-422b-91ae-364da2661108 (x_refsource_MISC, Not Applicable)
- cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2022-28944?
- CVE-2022-28944 is a high-severity vulnerability in Emcosoftware Msi Package Builder, classified under Download of Code Without Integrity Check. CVSS score: 8.8/10. Published 2022-05-23.
- How severe is CVE-2022-28944?
- High severity. CVSS v3 base score is 8.8 out of 10.
- Is CVE-2022-28944 known to be exploited?
- 14 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.