Vulnerability Intelligence Report
CVE-2022-28719
Missing authentication for critical function in AssetView prior to Ver.13.2.0 allows a remote unauthenticated attacker with some knowledge on the system configuration to upload a crafted configuration file to the managing server, which may result in the managed clients to execute arbitrary code with the administrative privilege.
No Active Exploit Signals
CVSS Base Score
9.8
CRITICAL
EPSS Probability:4.27%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| Hammock Corporation | AssetView | prior to Ver.13.2.0 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
4.273%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | JPCERT/CC · CERT · Japan |
| Reserved | 2022-04-14T00:00:00 |
| Published | 2022-04-28T08:25:12 |
| Last Updated | 2024-08-03T06:03:52 |
Community Chatter & Buzz