CVE-2022-2634CWE-250

Digi ConnectPort X2D

Critical · published August 9, 2022

CVSS v3.1
10.0
EPSS
1%
Percentile
62.6
In the wild
Unconfirmed
What it is

🚨 An attacker can upload and run malicious Python scripts just because the web app skipped some basic device access protections! 😱 Think of it like a restaurant that lets anyone in the kitchen to cook without checking if they have the right skills — you could end up with a surprise ingredient in your dish, or worse, a total disaster! 🍽️ This could lead to complete chaos, allowing an attacker to run arbitrary code and potentially take over the server. They could access sensitive data, manipulate applications, or wreak havoc on your system. The implications are absolutely devastating! 🔥

Put simply

Think of it like a restaurant that lets anyone in the kitchen to cook without checking if they have the right skills — you could end up with a surprise ingredient in your dish, or worse, a total disaster! 🍽️ This vulnerability arises from inadequate device access protections in the web application, meaning attackers can upload and execute Python files without proper permissions. It's a serious breach that could compromise the entire system.

What to do

This could lead to complete chaos, allowing an attacker to run arbitrary code and potentially take over the server. They could access sensitive data, manipulate applications, or wreak havoc on your system. The implications are absolutely devastating! 🔥 To remediate this, ensure strict device access controls are implemented and validate all uploaded files to prevent malicious code execution. Update your application to the latest version to close this security gap! 🛡️ You've got this! Follow these steps, and you'll keep your environment secure in no time! 💪✨

The record
Technical detail
CVSS v3.1
10.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01005 · 62.6th percentile
Weakness
CWE-250 · Execution with Unnecessary Privileges
Published
2022-08-09T20:18Z
EPSS history
Timeline
  • 09 AUG 20:18Z
    Digi ConnectPort X2D
    cvelistv5