CVE-2022-30534: critical vulnerability in WWBN AVideo
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
50Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.9epss 75%
In short
A flaw in WWBN AVideo's file processing feature allows attackers to run any system command by sending a specially-crafted request. This can give an attacker complete control over the server.
Technical detail
OS command injection vulnerability in aVideoEncoder chunkfile functionality (CWE-78) allows unauthenticated remote code execution via specially-crafted HTTP requests. The vulnerable code fails to properly sanitize user input before passing it to system command execution, enabling arbitrary command execution with server privileges.
Summary generated and translated by AI from the official description.
An OS command injection vulnerability exists in the aVideoEncoder chunkfile functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can send an HTTP request to trigger this vulnerability.
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected products
WWBN · AVideoRelated CVEs — WWBN AVideo
In the same product, most dangerous first.
CVE-2022-30690CRITICALCVE-2022-30690EPSS 83.9%CVE-2022-30547CRITICALCVE-2022-30547EPSS 63.7%CVE-2022-32572CRITICALCVE-2022-32572EPSS 24.1%CVE-2026-33478CRITICALAVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command InjectionEPSS 13.3%CVE-2023-32073HIGHAVideo command injection vulnerabilityEPSS 6.5%CVE-2023-30854HIGHWWBN AVideo vulnerable to OS Command InjectionEPSS 5.2%