CVE-2022-35516
Published: 17 August 2022
Summary
CVE-2022-35516 is a critical-severity Code Injection (CWE-94) vulnerability in Dedecms Dedecms. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 5.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
DedeCMS versions 5.7.93 through 5.7.96 contain a remote code execution vulnerability in login.php, tracked as CVE-2022-35516. The flaw carries a CVSS v3.1 score of 9.8 and is categorized under CWE-94, indicating improper control of code generation that can be triggered through the web interface.
An unauthenticated attacker with network access can exploit the issue without any user interaction or credentials, resulting in arbitrary code execution that grants full confidentiality, integrity, and availability impact on the affected installation.
Public references consist of proof-of-concept material demonstrating the login.php vector, but contain no details on vendor patches, workarounds, or official mitigation guidance. The associated EPSS score has remained flat at 0.1272 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-38403
Vulnerability details
DedeCMS v5.7.93 - v5.7.96 was discovered to contain a remote code execution vulnerability in login.php.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Makes persistent code injection into loaded programs impossible when the executable image itself resides on hardware-protected read-only media.
Dynamically generated code can be produced and executed inside the isolated chamber, preventing host compromise from code-injection payloads.
Validates inputs used in dynamic code generation to block injected directives.
Directly prevents execution of attacker-supplied code written into data memory regions.