CVE-2022-28944

HighCVSS 8.8/10Last modified Jul 9, 2026

Description

Certain EMCO Software products are affected by: CWE-494: Download of Code Without Integrity Check. This affects MSI Package Builder for Windows 9.1.4 and Remote Installer for Windows 6.0.13 and Ping Monitor for Windows 8.0.18 and Remote Shutdown for Windows 7.2.2 and WakeOnLan 2.0.8 and Network Inventory for Windows 5.8.22 and Network Software Scanner for Windows 2.0.8 and UnLock IT for Windows 6.1.1. The impact is: execute arbitrary code (remote). The component is: Updater. The attack vector is: To exploit this vulnerability, a user must trigger an update of an affected installation of EMCO Software. ¶¶ Multiple products from EMCO Software are affected by a remote code execution vulnerability during the update process.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-494

Affected software

No affected versions have been published.

Timeline

Published: May 23, 2022
Last modified: Jul 9, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-289459.8An issue in Webbank WeCube v3.2.2 allows attackers to execute a directory traversal via a crafted ZIP file.CVE-2022-289467.5An issue in the component ast/parser.go of Open Policy Agent v0.39.0 causes the application to incorrectly interpret every expression, causi CVE-2022-289487.5An issue in the Unmarshal function in Go-Yaml v3 causes the program to crash when attempting to deserialize invalid input.CVE-2022-28957.8Measuresoft ScadaPro Server (All Versions) uses unmaintained ActiveX controls. These controls may allow two stack-based buffer overflow inst CVE-2022-289557.5An access control issue in D-Link DIR816L_FW206b01 allows unauthenticated attackers to access folders folder_view.php and category_view.php.CVE-2022-289569.8An issue in the getcfg.php component of D-Link DIR816L_FW206b01 allows attackers to access the device via a crafted payload.CVE-2022-289596.1Multiple cross-site scripting (XSS) vulnerabilities in the component /spip.php of Spip Web Framework v3.1.13 and below allows attackers to e CVE-2022-28967.8Measuresoft ScadaPro Server (All Versions) allows use after free while processing a specific project file.CVE-2022-289608.8A PHP injection vulnerability in Spip before v3.2.8 allows attackers to execute arbitrary PHP code via the _oups parameter at /ecrire.CVE-2022-289618.8Spip Web Framework v3.1.13 and below was discovered to contain multiple SQL injection vulnerabilities at /ecrire via the lier_trad and where CVE-2022-289629.8Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via /scbs/classes/Users.php?f=delete_client.CVE-2022-289647.1An arbitrary file write vulnerability in Avast Premium Security before v21.11.2500 (build 21.11.6809.528) allows attackers to cause a Denial