CVE-2022-24631

Deeper analysis

CVE-2022-24631 is a stored cross-site scripting vulnerability affecting AudioCodes Device Manager Express through version 7.8.20002.47752. The flaw resides in the ajaxTenants.php script and can be triggered through the desc parameter, allowing attacker-controlled content to be persistently stored and later rendered for other users.

An authenticated user with low privileges can supply a malicious payload in the affected parameter. Because the vulnerability has a changed scope, the injected script executes in the browser context of other users who view the tainted data, resulting in limited impacts to confidentiality and integrity while requiring user interaction to trigger.

The EPSS score for this CVE rose from a low baseline to a peak of 0.0918 on 2026-02-23 before receding to the current value of 0.0029, indicating that exploitation interest emerged after public disclosure. The issue was detailed in a February 2023 Full Disclosure posting on Seclists.