CVE-2022-46306

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

ChangingTec ServiSign component has a path traversal vulnerability due to insufficient filtering for special characters in the DLL file path. An unauthenticated remote attacker can host a malicious website for the component user to access, which triggers the component to load malicious DLL files under arbitrary file path and allows the attacker to perform arbitrary system operation and disrupt of service.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Jan 3, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-463078.8SGUDA U-Lock central lock control service’s lock management function has incorrect authorization. A remote attacker with general privilege cCVE-2022-463088.8SGUDA U-Lock central lock control service’s user management function has incorrect authorization. A remote attacker with general user privilCVE-2022-463096.5Vitals ESP upload function has a path traversal vulnerability. A remote attacker with general user privilege can exploit this vulnerability CVE-2022-46316.1A vulnerability, which was classified as problematic, was found in WP-Ban. Affected is an unknown function of the file ban-options.php. The CVE-2022-463107.5The TelephonyProvider module has a vulnerability in obtaining values.Successful exploitation of this vulnerability may affect data confidentCVE-2022-463117.5The contacts component has a free (undefined) provider vulnerability. Successful exploitation of this vulnerability may affect data integritCVE-2022-463127.5The application management module has a vulnerability in permission verification. Successful exploitation of this vulnerability causes unexpCVE-2022-463135.3The sensor privacy module has an authentication vulnerability. Successful exploitation of this vulnerability may cause unavailability of theCVE-2022-463147.5The IPC module has defects introduced in the design process. Successful exploitation of this vulnerability may affect system availability.CVE-2022-463157.5The ProfileSDK has defects introduced in the design process. Successful exploitation of this vulnerability may affect system availability.CVE-2022-463169.8A thread security vulnerability exists in the authentication process. Successful exploitation of this vulnerability may affect data integritCVE-2022-463177.5The power consumption module has an out-of-bounds read vulnerability. Successful exploitation of this vulnerability may affect system availa
CVE-2022-46306: High severity, CVSS 7.8 | Vulnix