CVE-2022-39057

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

RAVA certificate validation system has insufficient filtering for special parameter of the web page input field. A remote attacker with administrator privilege can exploit this vulnerability to perform arbitrary system command and disrupt service.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
Changing Information Technology Inc.	RAVA certificate validation system	3

References

https://www.twcert.org.tw/tw/cp-132-6618-11fd8-1.htmlThird Party Advisory, VDB Entry
https://www.twcert.org.tw/tw/cp-132-6618-11fd8-1.htmlThird Party Advisory, VDB Entry

Timeline

Published: Oct 18, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-390587.5RAVA certification validation system has a path traversal vulnerability. An unauthenticated remote attacker can exploit this vulnerability t CVE-2022-390597.5ChangingTech MegaServiSignAdapter component has a path traversal vulnerability within its file reading function. An unauthenticated remote a CVE-2022-39064.8The Easy Form Builder WordPress plugin before 3.4.0 does not sanitise and escape some of its settings, which could allow high privilege user CVE-2022-390609.8ChangingTech MegaServiSignAdapter component has a vulnerability of improper input validation. An unauthenticated remote attacker can exploit CVE-2022-390616.5ChangingTech MegaServiSignAdapter component has a vulnerability of Out-of-bounds Read due to insufficient validation for parameter length. A CVE-2022-390627.8A vulnerability has been identified in SICAM TOOLBOX II (All versions < V07.10). Affected applications do not properly set permissions for p CVE-2022-390637.5When Open5GS UPF receives a PFCP Session Establishment Request, it stores related values for building the PFCP Session Establishment Respons CVE-2022-390648.1An attacker sending a single malformed IEEE 802.15.4 (Zigbee) frame makes the TRÅDFRI bulb blink, and if they replay (i.e. resend) the same CVE-2022-390656.5A single malformed IEEE 802.15.4 (Zigbee) frame makes the TRÅDFRI gateway unresponsive, such that connected lighting cannot be controlled wi CVE-2022-390668.8There is a SQL injection vulnerability in ZTE MF286R. Due to insufficient validation of the input parameters of the phonebook interface, an CVE-2022-390676.5There is a buffer overflow vulnerability in ZTE MF286R. Due to lack of input validation on parameters of the wifi interface, an authenticate CVE-2022-390686.5There is a buffer overflow vulnerability in ZTE MF296R. Due to insufficient validation of the SMS parameter length, an authenticated attacke