CVE-2022-24632

Deeper analysis

CVE-2022-24632 is a directory traversal vulnerability, tracked as CWE-22, that affects AudioCodes Device Manager Express through version 7.8.20002.47752. The flaw resides in BrowseFiles.php and is triggered through the view parameter during file download operations, allowing unauthorized access to files outside the intended directory. It carries a CVSS 3.1 base score of 5.3 reflecting network attack vector, low complexity, and no required privileges or user interaction, with limited confidentiality impact and no integrity or availability effects.

An unauthenticated remote attacker can exploit the issue by crafting malicious requests to the affected endpoint, enabling read access to arbitrary files on the server. This exposure could reveal sensitive configuration data, credentials, or other restricted content stored on the Device Manager Express host.

The EPSS score for the vulnerability rose from a low baseline to a peak of 0.5694 on 2025-12-11 before receding to the current value of 0.3182, indicating a period of increased exploitation interest after public disclosure.