Cyber Resilience

CVE-2022-24237

HighPublic PoCRCE

Published: 21 March 2022

Published
21 March 2022
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.2345 96.1th percentile
Risk Priority 32 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-24237 is a high-severity OS Command Injection (CWE-78) vulnerability in Snapt Aria. Its CVSS base score is 8.8 (High).

Operationally, ranked in the top 3.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

The vulnerability is a command injection flaw, tracked as CVE-2022-24237 and assigned CWE-78, that affects the snaptPowered2 component in Snapt Aria version 12.8. It carries a CVSS 3.1 score of 8.8 and permits execution of operating-system commands on the affected appliance.

Authenticated attackers with network access can exploit the issue without user interaction to run arbitrary commands, resulting in full compromise of confidentiality, integrity, and availability on the target system.

Public references consist of a March 2022 technical disclosure and the vendor’s product page for Aria ADC; neither source details patches or configuration work-arounds.

EPSS for the CVE rose from a low baseline after disclosure to a peak of 0.5173 on 2025-01-22 before receding to the current value of 0.2345, indicating a period of increased exploitation interest well after the original publication date.

EU & UK References

Vulnerability details

The snaptPowered2 component of Snapt Aria v12.8 was discovered to contain a command injection vulnerability. This vulnerability allows authenticated attackers to execute arbitrary commands.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

snapt
aria
12.8

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-78

Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.

addresses: CWE-78

Validates inputs to block special elements that would alter OS command execution.

References