Cyber Resilience

CVE-2022-36566

CriticalPublic PoCRCE

Published: 31 August 2022

Published
31 August 2022
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0497 89.9th percentile
Risk Priority 23 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-36566 is a critical-severity OS Command Injection (CWE-78) vulnerability in Yogeshojha Rengine. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 10.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

Rengine version 1.3.0 contains a command injection vulnerability, tracked as CVE-2022-36566 and assigned CWE-78, that affects the scan engine function. The flaw received a CVSS 3.1 base score of 9.8, reflecting network attack vector, low attack complexity, and no required privileges or user interaction, with high impact on confidentiality, integrity, and availability.

An unauthenticated attacker with network access can supply crafted input to the scan engine and execute arbitrary operating-system commands on the underlying host, resulting in full compromise of the affected Rengine instance.

Public references consist of GitHub issue reports that document the discovery; no vendor advisory or patch information is supplied in the available references. The associated EPSS score has remained low, moving only from a starting value near 0.05 to a peak of 0.0514.

EU & UK References

Vulnerability details

Rengine v1.3.0 was discovered to contain a command injection vulnerability via the scan engine function.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

yogeshojha
rengine
1.3.0

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-78

Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.

addresses: CWE-78

Validates inputs to block special elements that would alter OS command execution.

References