CVE-2022-24237
Published: 21 March 2022
Summary
CVE-2022-24237 is a high-severity OS Command Injection (CWE-78) vulnerability in Snapt Aria. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 3.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The vulnerability is a command injection flaw, tracked as CVE-2022-24237 and assigned CWE-78, that affects the snaptPowered2 component in Snapt Aria version 12.8. It carries a CVSS 3.1 score of 8.8 and permits execution of operating-system commands on the affected appliance.
Authenticated attackers with network access can exploit the issue without user interaction to run arbitrary commands, resulting in full compromise of confidentiality, integrity, and availability on the target system.
Public references consist of a March 2022 technical disclosure and the vendor’s product page for Aria ADC; neither source details patches or configuration work-arounds.
EPSS for the CVE rose from a low baseline after disclosure to a peak of 0.5173 on 2025-01-22 before receding to the current value of 0.2345, indicating a period of increased exploitation interest well after the original publication date.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-29144
Vulnerability details
The snaptPowered2 component of Snapt Aria v12.8 was discovered to contain a command injection vulnerability. This vulnerability allows authenticated attackers to execute arbitrary commands.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.