CVE-2022-30534
50Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.9epss 75%
exploitation probability
75%top 1% of all CVEs
observed exploitation
nono source reports it
In short
A flaw in WWBN AVideo's file processing feature allows attackers to run any system command by sending a specially-crafted request. This can give an attacker complete control over the server.
Technical detail
OS command injection vulnerability in aVideoEncoder chunkfile functionality (CWE-78) allows unauthenticated remote code execution via specially-crafted HTTP requests. The vulnerable code fails to properly sanitize user input before passing it to system command execution, enabling arbitrary command execution with server privileges.
Summary generated and translated by AI from the official description.
An OS command injection vulnerability exists in the aVideoEncoder chunkfile functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can send an HTTP request to trigger this vulnerability.
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected products
WWBN · AVideo