CVE-2022-24627 is an unauthenticated SQL injection vulnerability affecting AudioCodes Device Manager Express through version 7.8.20002.47752, specifically within the 'p' parameter of the process_login.php login form. This critical vulnerability, with a CVSS score of 9.8, allows for complete compromise of confidentiality, integrity, and availability due to its network-based attack vector and low complexity. While not currently on CISA's KEV catalog, public exploit code, including a Metasploit module for Remote Code Execution and Nuclei templates, is available, indicating a high potential for exploitation. Despite the availability of exploits, there is currently no significant community discussion or media coverage surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 7.8.20002.47752CPE matchmatch criteria | cpe:2.3:a:audiocodes:device_manager_express:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.