CVE-2022-46304

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

ChangingTec ServiSign component has insufficient filtering for special characters in the connection response parameter. An unauthenticated remote attacker can host a malicious website for the component user to access, which triggers command injection and allows the attacker to execute arbitrary system command to perform arbitrary system operation or disrupt service.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Jan 3, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-463056.5ChangingTec ServiSign component has a path traversal vulnerability. An unauthenticated LAN attacker can exploit this vulnerability to bypassCVE-2022-463067.8ChangingTec ServiSign component has a path traversal vulnerability due to insufficient filtering for special characters in the DLL file pathCVE-2022-463078.8SGUDA U-Lock central lock control service’s lock management function has incorrect authorization. A remote attacker with general privilege cCVE-2022-463088.8SGUDA U-Lock central lock control service’s user management function has incorrect authorization. A remote attacker with general user privilCVE-2022-463096.5Vitals ESP upload function has a path traversal vulnerability. A remote attacker with general user privilege can exploit this vulnerability CVE-2022-46316.1A vulnerability, which was classified as problematic, was found in WP-Ban. Affected is an unknown function of the file ban-options.php. The CVE-2022-463107.5The TelephonyProvider module has a vulnerability in obtaining values.Successful exploitation of this vulnerability may affect data confidentCVE-2022-463117.5The contacts component has a free (undefined) provider vulnerability. Successful exploitation of this vulnerability may affect data integritCVE-2022-463127.5The application management module has a vulnerability in permission verification. Successful exploitation of this vulnerability causes unexpCVE-2022-463135.3The sensor privacy module has an authentication vulnerability. Successful exploitation of this vulnerability may cause unavailability of theCVE-2022-463147.5The IPC module has defects introduced in the design process. Successful exploitation of this vulnerability may affect system availability.CVE-2022-463157.5The ProfileSDK has defects introduced in the design process. Successful exploitation of this vulnerability may affect system availability.
CVE-2022-46304: High severity, CVSS 8.8 | Vulnix