CVE-2022-24915

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The absence of filters when loading some sections in the web application of the vulnerable device allows attackers to inject malicious code that will be interpreted when a legitimate user accesses the web section where the information is displayed. Injection can be done on specific parameters. The injected code is executed when a legitimate user attempts to upload, copy, download, or delete an existing configuration (Administrative Services).

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Mar 10, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-249167.5Optimism before @eth-optimism/l2geth@0.5.11 allows economic griefing because a balance is duplicated upon contract self-destruction.CVE-2022-249174.4An authenticated user can create a link with reflected Javascript code inside it for services’ page and send it to other users. The payload CVE-2022-249184.4An authenticated user can create a link with reflected Javascript code inside it for items’ page and send it to other users. The payload can CVE-2022-249194.4An authenticated user can create a link with reflected Javascript code inside it for graphs’ page and send it to other users. The payload ca CVE-2022-24928.8A vulnerability was found in SourceCodester Library Management System 1.0 and classified as critical. This issue affects some unknown proces CVE-2022-249217.5regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply nested expression.CVE-2022-249233.3Improper access control vulnerability in Samsung SearchWidget prior to versions 2.3.00.6 in China models allows untrusted applications to lo CVE-2022-249245.3An improper access control in LiveWallpaperService prior to versions 3.0.9.0 allows to create a specific named system directory without a pr CVE-2022-249256.5Improper input validation vulnerability in SettingsProvider prior to Android S(12) allows privileged attackers to trigger a permanent denial CVE-2022-249265.4Improper input validation vulnerability in SmartTagPlugin prior to version 1.2.15-6 allows privileged attackers to trigger a XSS on a victim CVE-2022-249279.8Improper privilege management vulnerability in Samsung Video Player prior to version 7.3.15.30 allows attackers to execute video files witho CVE-2022-249287.8Security misconfiguration of RKP in kernel prior to SMR Mar-2022 Release 1 allows a system not to be protected by RKP.