CVE-2022-47911

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 does not properly validate the input module name to the backup services of the software. This could allow a remote attacker to access sensitive functions of the application and execute arbitrary system commands.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
Sewio	RTLS Studio	>= 2.0.0, <= 2.6.2

References

https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-01Third Party Advisory, US Government Resource
https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-01Third Party Advisory, US Government Resource

Timeline

Published: Jan 18, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-479157.8The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13. An app may be able to execute arbitrary code CVE-2022-479176.5Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 is vulnerable to improper input validation o CVE-2022-47925.4The News & Blog Designer Pack WordPress plugin before 3.3 does not validate and escape one of its shortcode attributes, which could allow us CVE-2022-479246.5An high privileged attacker may pass crafted arguments to the validate function of csaf-validator-lib of a locally installed Secvisogram in CVE-2022-479257.5The validate JSON endpoint of the Secvisogram csaf-validator-service in versions < 0.1.0 processes tests with unexpected names. This insuffi CVE-2022-479269.8AyaCMS 3.1.2 is vulnerable to file deletion via /aya/module/admin/fst_del.inc.php CVE-2022-479275.5An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. When installing with a pr CVE-2022-479286.1In MISP before 2.4.167, there is XSS in the template file uploads in app/View/Templates/upload_file.ctp.CVE-2022-479295.5In the Linux kernel before 6.1.6, a NULL pointer dereference bug in the traffic control subsystem allows an unprivileged user to trigger a d CVE-2022-47935.4The Blog Designer WordPress plugin before 2.4.1 does not validate and escape one of its shortcode attributes, which could allow users with a CVE-2022-479306.8An issue was discovered in IO FinNet tss-lib before 2.0.0. The parameter ssid for defining a session id is not used through the MPC implemen CVE-2022-479319.1IO FinNet tss-lib before 2.0.0 allows a collision of hash values.