Cyber Resilience

CVE-2022-34822

Critical

Published: 08 November 2022

Published
08 November 2022
Modified
02 May 2025
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0537 90.3th percentile
Risk Priority 23 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-34822 is a critical-severity Path Traversal (CWE-22) vulnerability in Nec Expresscluster X. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 9.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

CVE-2022-34822 is a path traversal vulnerability, tracked under CWE-22, that affects CLUSTERPRO X 5.0 for Windows and earlier versions along with EXPRESSCLUSTER X 5.0 for Windows and earlier, including the SingleServerSafe variants of both products. The flaw permits remote manipulation of file paths, enabling unauthorized writes to arbitrary locations on the underlying file system.

A remote unauthenticated attacker can exploit the issue over the network without credentials or user interaction to overwrite existing files and potentially achieve arbitrary code execution, consistent with the CVSS 9.8 rating reflecting full confidentiality, integrity, and availability impact.

Vendor guidance is published in the NEC advisory at https://jpn.nec.com/security-info/secinfo/nv22-014_en.html, which addresses the affected CLUSTERPRO and EXPRESSCLUSTER releases.

EPSS scores for the CVE remain low, with a current value of 0.0537 and a peak of 0.0653.

EU & UK References

Vulnerability details

Path traversal vulnerability in CLUSTERPRO X 5.0 for Windows and earlier, EXPRESSCLUSTER X 5.0 for Windows and earlier, CLUSTERPRO X 5.0 SingleServerSafe for Windows and earlier, EXPRESSCLUSTER X 5.0 SingleServerSafe for Windows and earlier allows a remote unauthenticated attacker to…

more

overwrite existing files on the file system and to potentially execute arbitrary code.

CWE(s)
CWE-22

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

nec
expresscluster x
≤ 5.0
nec
expresscluster x singleserversafe
≤ 5.0

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SI-10 Information Input Validation
addresses: CWE-22

Validates pathnames and filenames to prevent traversal outside intended directories.

References