What is the CVSS score of CVE-2022-27438?

CVE-2022-27438 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 2.4%.

Is there a public PoC exploit available for CVE-2022-27438?

Yes, a public proof-of-concept exploit is available for CVE-2022-27438. Prioritise patching immediately. EPSS: 2.4%.

Is there a patch available for CVE-2022-27438?

Yes, a patch is available for CVE-2022-27438. Update the affected software to the latest version immediately.

Advanced Installer CVE-2022-27438

HIGH

Download of Code Without Integrity Check (CWE-494)

2022-06-06 cve@mitre.org

RCE Advanced Installer Call Flow Designer Crm Template Generator Boomtv Streamer Portal Direct Folders Teracopy Emeditor Flamory Free Snipping Tool Fxsound Better Explorer Gamecaster Mailbird Guzogo Honeygain Vi Package Manager Take Command Archive Password Recovery Asterisks Password Decryptor Burning Suite Rar Password Recovery Volume Serial Number Editor Zip Password Recovery Password Agent Scptoolkit Plagiarism Checker X Prusaslicer Mycleanid Mycleanpc Mypasslock Angry Birds Space Bad Piggies Displaylink Usb Graphics Urban Vpn Vigembus Driver Vpnhood Virtual Desktop Streamer Xsplit Express Video Editor Vw0420 Firmware Inclinalysis Digital Inclinometer Ipi Utility Rstar Rtu Host Dt2011 Firmware Dt2011B Firmware Dt2040 Firmware Dt2050 Firmware Dt2050B Firmware Dt2055B Firmware Dt2306 Firmware Dt2350 Firmware Dt2485 Firmware Dt4205 Firmware Dtsaa Firmware Ic6560 Firmware Ic6660 Firmware Dtl201B 2B Firmware Mtcm Firmware Gaa2820 Firmware Rtu Firmware Mems Tilt Meter Firmware Portable Tilt Meter Firmware Vw2106 Firmware Th2016 Firmware Th2016B Firmware Ma7 Firmware Qb120 Firmware Sg350 Firmware Ir420 Firmware Lp100 Firmware C109 Firmware

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Jun 06, 2022 - 23:15 nvd

HIGH 8.1

DescriptionNVD

Caphyon Ltd Advanced Installer 19.3 and earlier and many products that use the updater from Advanced Installer (Advanced Updater) are affected by a remote code execution vulnerability via the CustomDetection parameter in the update check function. To exploit this vulnerability, a user must start an affected installation to trigger the update check.

AnalysisAI

Caphyon Ltd Advanced Installer 19.3 and earlier and many products that use the updater from Advanced Installer (Advanced Updater) are affected by a remote code execution vulnerability via the. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.

Technical ContextAI

This vulnerability is classified under CWE-494. Caphyon Ltd Advanced Installer 19.3 and earlier and many products that use the updater from Advanced Installer (Advanced Updater) are affected by a remote code execution vulnerability via the CustomDetection parameter in the update check function. To exploit this vulnerability, a user must start an affected installation to trigger the update check. Affected products include: Caphyon Advanced Installer, 3Cx Call Flow Designer, 3Cx Crm Template Generator, Boom Boomtv Streamer Portal, Codesector Direct Folders.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.