CVE-2022-32572criticalCWE-78

CVE-2022-32572: critical vulnerability in WWBN AVideo

Published · Updated

Follow this CVE+ Monitor AVideo

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.9epss 24%
In short

A flaw in WWBN AVideo allows attackers to run arbitrary commands on the server by sending a specially-crafted HTTP request to the wget functionality. This can give attackers complete control over the affected system.

Technical detail

An OS command injection vulnerability exists in the aVideoEncoder wget functionality (CWE-78) affecting WWBN AVideo 11.6 and dev master. Unsanitized user input is passed to system commands, allowing remote attackers to execute arbitrary OS commands via HTTP requests without authentication requirements. The impact is complete system compromise.

Summary generated and translated by AI from the official description.
An os command injection vulnerability exists in the aVideoEncoder wget functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can send an HTTP request to trigger this vulnerability.
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected products
WWBN · AVideo
Related CVEs — WWBN AVideo

In the same product, most dangerous first.

CVE-2022-30690CRITICALCVE-2022-30690EPSS 83.9%CVE-2022-30534CRITICALCVE-2022-30534EPSS 75.0%CVE-2022-30547CRITICALCVE-2022-30547EPSS 63.7%CVE-2026-33478CRITICALAVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command InjectionEPSS 13.3%CVE-2023-32073HIGHAVideo command injection vulnerabilityEPSS 6.5%CVE-2023-30854HIGHWWBN AVideo vulnerable to OS Command InjectionEPSS 5.2%