CVE-2022-36566
Published: 31 August 2022
Summary
CVE-2022-36566 is a critical-severity OS Command Injection (CWE-78) vulnerability in Yogeshojha Rengine. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 10.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Rengine version 1.3.0 contains a command injection vulnerability, tracked as CVE-2022-36566 and assigned CWE-78, that affects the scan engine function. The flaw received a CVSS 3.1 base score of 9.8, reflecting network attack vector, low attack complexity, and no required privileges or user interaction, with high impact on confidentiality, integrity, and availability.
An unauthenticated attacker with network access can supply crafted input to the scan engine and execute arbitrary operating-system commands on the underlying host, resulting in full compromise of the affected Rengine instance.
Public references consist of GitHub issue reports that document the discovery; no vendor advisory or patch information is supplied in the available references. The associated EPSS score has remained low, moving only from a starting value near 0.05 to a peak of 0.0514.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-39272
Vulnerability details
Rengine v1.3.0 was discovered to contain a command injection vulnerability via the scan engine function.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.