CVE-2022-32572
33Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.9epss 24%
exploitation probability
24%top 2% of all CVEs
observed exploitation
nono source reports it
In short
A flaw in WWBN AVideo allows attackers to run arbitrary commands on the server by sending a specially-crafted HTTP request to the wget functionality. This can give attackers complete control over the affected system.
Technical detail
An OS command injection vulnerability exists in the aVideoEncoder wget functionality (CWE-78) affecting WWBN AVideo 11.6 and dev master. Unsanitized user input is passed to system commands, allowing remote attackers to execute arbitrary OS commands via HTTP requests without authentication requirements. The impact is complete system compromise.
Summary generated and translated by AI from the official description.
An os command injection vulnerability exists in the aVideoEncoder wget functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can send an HTTP request to trigger this vulnerability.
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected products
WWBN · AVideo