CVE-2022-28944
CVSS V2 Medium 6.8
CVSS V3 High 8.8
Description
Certain EMCO Software products are affected by: CWE-494: Download of Code Without Integrity Check. This affects MSI Package Builder for Windows 9.1.4 and Remote Installer for Windows 6.0.13 and Ping Monitor for Windows 8.0.18 and Remote Shutdown for Windows 7.2.2 and WakeOnLan 2.0.8 and Network Inventory for Windows 5.8.22 and Network Software Scanner for Windows 2.0.8 and UnLock IT for Windows 6.1.1. The impact is: execute arbitrary code (remote). The component is: Updater. The attack vector is: To exploit this vulnerability, a user must trigger an update of an affected installation of EMCO Software. ¶¶ Multiple products from EMCO Software are affected by a remote code execution vulnerability during the update process.
Overview
- CVE ID
- CVE-2022-28944
- Assigner
- cve@mitre.org
- Vulnerability Status
- Analyzed
- Published Version
- 2022-05-23T18:16:11
- Last Modified Date
- 2022-06-07T15:08:23
Weakness Enumerations
CPE Configuration (Product)
| CPE | Vulnerable | Operator | Version Start | Version End |
|---|---|---|---|---|
| AND | ||||
| cpe:2.3:a:emcosoftware:msi_package_builder:9.1.4:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:a:emcosoftware:network_inventory:5.8.22:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:a:emcosoftware:network_software_scanner:2.0.8:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:a:emcosoftware:ping_monitor:8.0.18:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:a:emcosoftware:remote_installer:6.0.13:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:a:emcosoftware:remote_shutdown:7.2.2:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:a:emcosoftware:unlock_it:6.1.1:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* | 0 | OR | ||
| AND | ||||
| cpe:2.3:a:emcosoftware:wakeonlan:2.0.8:*:*:*:free:*:*:* | 1 | OR | ||
| cpe:2.3:a:emcosoftware:wakeonlan:2.0.8:*:*:*:professional:*:*:* | 1 | OR |
CVSS Version 2
- Version
- 2.0
- Vector String
- AV:N/AC:M/Au:N/C:P/I:P/A:P
- Access Vector
- NETWORK
- Access Compatibility
- MEDIUM
- Authentication
- NONE
- Confidentiality Impact
- PARTIAL
- Integrity Impact
- PARTIAL
- Availability Impact
- PARTIAL
- Base Score
- 6.8
- Severity
- MEDIUM
- Exploitability Score
- 8.6
- Impact Score
- 6.4
CVSS Version 3
- Version
- 3.1
- Vector String
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Attack Vector
- NETWORK
- Attack Compatibility
- LOW
- Privileges Required
- NONE
- User Interaction
- REQUIRED
- Scope
- UNCHANGED
- Confidentiality Impact
- HIGH
- Availability Impact
- HIGH
- Base Score
- 8.8
- Base Severity
- HIGH
- Exploitability Score
- 2.8
- Impact Score
- 5.9
References
| Reference URL | Reference Tags |
|---|---|
| http://emco.com | |
| https://github.com/gerr-re/cve-2022-28944/blob/main/cve-2022-28944_public-advisory.pdf | |
| http://msi.com |
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2022-28944 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28944 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2022-05-23 19:00:10 | Added to TrackCVE |