CVE-2022-28339

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Trend Micro HouseCall for Home Networks version 5.3.1302 and below contains an uncontrolled search patch element vulnerability that could allow an attacker with low user privileges to create a malicious DLL that could lead to escalated privileges.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-427

Affected software

Vendor	Product	Versions
Trend Micro, Inc.	Trend Micro HouseCall for Home Networks	>= 5.3, < 5.3.1308

References

https://helpcenter.trendmicro.com/en-us/article/tmka-21734Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-22-620/Third Party Advisory

Timeline

Published: Feb 22, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2022

CVE-2022-28345.3The Helpful WordPress plugin before 4.5.26 puts the exported logs and feedbacks in a publicly accessible location and guessable names, which CVE-2022-283457.5The Signal app before 5.34 for iOS allows URI spoofing via RTLO injection. It incorrectly renders RTLO encoded URLs beginning with a non-bre CVE-2022-283469.8An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate(), aggregate(), and extra() CVE-2022-283479.8A SQL injection issue was discovered in QuerySet.explain() in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. This occurs CVE-2022-283489.8Arm Mali GPU Kernel Driver (Midgard r4p0 through r31p0, Bifrost r0p0 through r36p0 before r37p0, and Valhall r19p0 through r36p0 before r37p CVE-2022-283499.8Arm Mali GPU Kernel Driver has a use-after-free: Midgard r28p0 through r29p0 before r30p0, Bifrost r17p0 through r23p0 before r24p0, and Val CVE-2022-28354.4A flaw was found in coreDNS. This flaw allows a malicious user to reroute internal calls to some internal services that were accessed by the CVE-2022-283509.8Arm Mali GPU Kernel Driver allows improper GPU operations in Valhall r29p0 through r36p0 before r37p0 to reach a use-after-free situation.CVE-2022-283524.8WeeChat (aka Wee Enhanced Environment for Chat) 3.2 to 3.4 before 3.4.1 does not properly verify the TLS certificate of the server, after ce CVE-2022-283536.1In the External Redirect Warning Plugin 1.3 for MyBB, the redirect URL (aka external.php?url=) is vulnerable to XSS.CVE-2022-283546.1In the Active Threads Plugin 1.3.0 for MyBB, the activethreads.php date parameter is vulnerable to XSS when setting a time period.CVE-2022-283557.5randomUUID in Scala.js before 1.10.0 generates predictable values.