CVE-2022-26151
Published: 13 April 2022
Summary
CVE-2022-26151 is a high-severity Command Injection (CWE-77) vulnerability in Citrix Xenmobile Server. Its CVSS base score is 7.2 (High).
Operationally, ranked in the top 9.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Citrix XenMobile Server versions 10.12 through RP11, 10.13 through RP7, and 10.14 through RP4 contain a command injection vulnerability tracked as CVE-2022-26151 and CWE-77. The flaw carries a CVSS 3.1 score of 7.2 and stems from insufficient input validation that permits arbitrary operating-system commands to be executed on the server.
An attacker with administrative credentials can send specially crafted requests over the network to trigger the injection. Successful exploitation grants full control over confidentiality, integrity, and availability of the affected XenMobile instance, allowing the attacker to run commands with the privileges of the server process.
Citrix has published remediation guidance and updated builds in security bulletin CTX370551, directing customers to apply the relevant rolling patches or upgrade to a fixed release. The associated EPSS score has remained flat at 0.0582 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-30717
Vulnerability details
Citrix XenMobile Server 10.12 through RP11, 10.13 through RP7, and 10.14 through RP4 allows Command Injection.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.