CVE-2022-42982

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

BKG Professional NtripCaster 2.0.39 allows querying information over the UDP protocol without authentication. The NTRIP sourcetable is typically quite long (tens of kBs) and can be requested with a packet of only 30 bytes. This presents a vector that can be used for UDP amplification attacks. Normally, only authenticated streaming data will be provided over UDP and not the sourcetable.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-306

Affected software

No affected versions have been published.

Timeline

Published: Nov 17, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-429838.8anji-plus AJ-Report 0.9.8.6 allows remote attackers to bypass login authentication by spoofing JWT Tokens.CVE-2022-429849.8WoWonder Social Network Platform 4.1.4 was discovered to contain a SQL injection vulnerability via the offset parameter at requests.php?f=se CVE-2022-429854.8The ScratchLogin extension through 1.1 for MediaWiki does not escape verification failure messages, which allows users with administrator pr CVE-2022-429899.0ERP Sankhya before v4.11b81 was discovered to contain a cross-site scripting (XSS) vulnerability via the component Caixa de Entrada.CVE-2022-42994.8The Metricool WordPress plugin before 1.18 does not sanitise and escape some of its settings, which could allow high privilege users such as CVE-2022-429907.2Food Ordering Management System v1.0 was discovered to contain a SQL injection vulnerability via the component /foms/all-orders.php?status=C CVE-2022-429915.4A stored cross-site scripting (XSS) vulnerability in Simple Online Public Access Catalog v1.0 allows attackers to execute arbitrary web scri CVE-2022-429925.4Multiple stored cross-site scripting (XSS) vulnerabilities in Train Scheduler App v1.0 allow attackers to execute arbitrary web scripts or H CVE-2022-429935.4Password Storage Application v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Setup page.CVE-2022-429989.8D-Link DIR-816 A2 1.10 B05 was discovered to contain a stack overflow via the srcip parameter at /goform/form2IPQoSTcAdd.CVE-2022-429997.5D-Link DIR-816 A2 1.10 B05 was discovered to contain multiple command injection vulnerabilities via the admuser and admpass parameters at /g CVE-2022-43008.8A vulnerability was found in FastCMS. It has been rated as critical. This issue affects some unknown processing of the file /template/edit o