What is CVE-2022-46304?

CVE-2022-46304 is a high-severity vulnerability in Changingtec Servisign, classified under OS Command Injection. CVSS score: 8.8/10. Published 2023-01-03.

How severe is CVE-2022-46304?

High severity. CVSS v3 base score is 8.8 out of 10.

RCE in Changingtec Servisign

CVE-2022-46304

ChangingTec ServiSign component has insufficient filtering for special characters in the connection response parameter. An unauthenticated remote attacker can host a malicious website for the component user to access, which triggers command injection and allows the attacker to execute arbitrary system command to perform arbitrary system operation or disrupt service.

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.015 (71.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

Affected products

Changingtec Servisign — versions 0

Weakness classification (CWE)

CWE-78 — OS Command Injection

References

twcert@cert.org.tw (VDB Entry, Third Party Advisory)

Frequently asked questions

What is CVE-2022-46304?: CVE-2022-46304 is a high-severity vulnerability in Changingtec Servisign, classified under OS Command Injection. CVSS score: 8.8/10. Published 2023-01-03.
How severe is CVE-2022-46304?: High severity. CVSS v3 base score is 8.8 out of 10.