CVE-2022-1410

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

OS Command Injection vulnerability in the db_optimize component of Device42 Asset Management Appliance allows an authenticated attacker to execute remote code on the device. This issue affects: Device42 CMDB version 18.01.00 and prior versions.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
Device42	CMDB	>= unspecified, < 18.01.00

References

https://www.bitdefender.com/blog/labs/a-red-team-perspective-on-the-device42-asset-management-appliance/Third Party Advisory
https://www.bitdefender.com/blog/labs/a-red-team-perspective-on-the-device42-asset-management-appliance/Third Party Advisory

Timeline

Published: Aug 17, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-14116.1Unrestructed file upload in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0. Attacker can send malicious files to the victims CVE-2022-14127.5The Log WP_Mail WordPress plugin through 0.1 saves sent email in a publicly accessible directory using predictable filenames, allowing any u CVE-2022-14137.5Missing input masking in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions from 14.9.0 before 14.9.4, and CVE-2022-14148.83scale API Management 2 does not perform adequate sanitation for user input in multiple fields. An authenticated user could use this flaw to CVE-2022-14158.8A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authen CVE-2022-14165.4Missing sanitization of data in Pipeline error messages in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versio CVE-2022-14174.3Improper access control in GitLab CE/EE affecting all versions starting from 8.12 before 14.8.6, all versions starting from 14.9 before 14.9 CVE-2022-14186.1The Social Stickers WordPress plugin through 2.2.9 does not have CSRF checks in place when updating its Social Network settings, and does no CVE-2022-14197.8The root cause of this vulnerability is that the ioctl$DRM_IOCTL_MODE_DESTROY_DUMB can decrease refcount of *drm_vgem_gem_object *(created i CVE-2022-14205.5Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4774.CVE-2022-14214.3The Discy WordPress theme before 5.2 lacks CSRF checks in some AJAX actions, allowing an attacker to make a logged in admin change arbitrary CVE-2022-14226.5The Discy WordPress theme before 5.2 does not check for CSRF tokens in the AJAX action discy_reset_options, allowing an attacker to trick an