How severe is CVE-2022-24140?

This vulnerability has a severity rating of MEDIUM with a CVSS score of 6.6 out of 10.

What type of vulnerability is CVE-2022-24140?

This is classified as CWE-494, which is a common weakness in software security.

CVE-2022-24140 - MEDIUM Severity | CVSS 6.6

Vulnerability Description

IOBit Advanced System Care 15, iTop Screen Recorder 2.1, iTop VPN 3.2, Driver Booster 9, and iTop Screenshot sends HTTP requests in their update procedure in order to download a config file. After downloading the config file, the products will parse the HTTP location of the update from the file and will try to install the update automatically with ADMIN privileges. An attacker Intercepting this communication can supply the product a fake config file with malicious locations for the updates thus gaining a remote code execution on an endpoint.

Related Vulnerabilities

CVE-2021-3485

MEDIUM

CVSS:6.6(Medium)

An Improper Input Validation vulnerability in the Product Update feature of Bitdefender Endpoint Security Tools for Linux allows a man-in-the-middle attacker to abuse the DownloadFile function of the ...

CWE-4942021

CVE-2021-41714

MEDIUM

CVSS:6.5(Medium)

In Tipask < 3.5.9, path parameters entered by the user are not validated when downloading attachments, a registered user can download arbitrary files on the Tipask server such as .env, /etc/passwd, la...

CWE-4942021

CVE-2022-31324

MEDIUM

CVSS:6.5(Medium)

An arbitrary file download vulnerability in the downloadAction() function of Penta Security Systems Inc WAPPLES v6.0 r3 4.10-hotfix1 allows attackers to download arbitrary files via a crafted POST req...

CWE-4942022

CVE-2022-37908

MEDIUM

CVSS:6.5(Medium)

An authenticated attacker can impact the integrity of the ArubaOS bootloader on 7xxx series controllers. Successful exploitation can compromise the hardware chain of trust on the impacted controller.

CWE-4942022

CVE-2022-4261

MEDIUM

CVSS:6.5(Medium)

Rapid7 Nexpose and InsightVM versions prior to 6.6.172 failed to reliably validate the authenticity of update contents. This failure could allow an attacker to provide a malicious update and alter the...

CWE-4942022

CVE-2023-24500

MEDIUM

CVSS:6.5(Medium)

Electra Central AC unit – Adjacent attacker may cause the unit to load unauthorized FW.

CWE-4942023