What is CVE-2022-34006?

CVE-2022-34006 is a high-severity vulnerability in Southrivertech Titan FTP Server Nextgen, classified under Improper Privilege Management. CVSS score: 7.8/10. Published 2022-06-19.

How severe is CVE-2022-34006?

High severity. CVSS v3 base score is 7.8 out of 10.

Privilege escalation in Southrivertech Titan FTP Server Nextgen

CVE-2022-34006

An issue was discovered in TitanFTP (aka Titan FTP) NextGen before 1.2.1050. When installing, Microsoft SQL Express 2019 installs by default with an SQL instance running as SYSTEM with BUILTIN\Users as sysadmin, thus enabling unprivileged Windows users to execute commands locally as NT AUTHORITY\SYSTEM, aka NX-I674 (sub-issue 2). NOTE: as of 2022-06-21, the 1.2.1050 release corrects this vulnerability in a new installation, but not in an upgrade installation.

Vulnerability class: Privilege Escalation

EPSS: 0.003 (17.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Southrivertech Titan_ftp_server_nextgen
N/a — versions n/a

Weakness classification (CWE)

CWE-269 — Improper Privilege Management

References

cve@mitre.org (x_refsource_MISC, Release Notes, Vendor Advisory)

Frequently asked questions

What is CVE-2022-34006?: CVE-2022-34006 is a high-severity vulnerability in Southrivertech Titan FTP Server Nextgen, classified under Improper Privilege Management. CVSS score: 7.8/10. Published 2022-06-19.
How severe is CVE-2022-34006?: High severity. CVSS v3 base score is 7.8 out of 10.