Cyber Resilience

CVE-2022-24627

CriticalPublic PoC

Published: 29 May 2023

Published
29 May 2023
Modified
14 January 2025
KEV Added
Patch
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.4897 97.8th percentile
Risk Priority 49 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-24627 is a critical-severity SQL Injection (CWE-89) vulnerability in Audiocodes Device Manager Express. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 2.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

CVE-2022-24627 is an unauthenticated SQL injection vulnerability in AudioCodes Device Manager Express through version 7.8.20002.47752. The flaw resides in the p parameter of the process_login.php login form and is tracked under CWE-89, carrying a CVSS 3.1 base score of 9.8.

An attacker with network access can supply crafted input to the affected parameter without authentication or user interaction, enabling arbitrary SQL execution that may result in full confidentiality, integrity, and availability impact on the underlying database and application.

The two listed references both point to the same February 2023 Full Disclosure post that originally reported the issue; no vendor advisory or patch information is supplied in the available references. The associated EPSS score reached a peak of 0.5881 before receding to its current value of 0.4543.

EU & UK References

Vulnerability details

An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is an unauthenticated SQL injection in the p parameter of the process_login.php login form.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

audiocodes
device manager express
≤ 7.8.20002.47752

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-89

Penetration testing uses SQL injection payloads against database interfaces, identifying and supporting fixes for SQL injection weaknesses.

addresses: CWE-89

Validates query inputs to prevent SQL syntax or command manipulation.

References