Cyber Resilience

CVE-2022-37718

HighPublic PoCRCE

Published: 23 January 2023

Published
23 January 2023
Modified
02 April 2025
KEV Added
—
Patch
—
CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.1494 94.7th percentile
Risk Priority 27 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-37718 is a high-severity OS Command Injection (CWE-78) vulnerability in Edgenexus Application Delivery Controller. Its CVSS base score is 8.8 (High).

Operationally, ranked in the top 5.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

The management portal component of JetNexus/EdgeNexus ADC version 4.2.8 contains a command injection vulnerability tracked as CVE-2022-37718 and assigned CWE-78. The flaw permits execution of operating system commands and carries a CVSS 3.1 score of 8.8 reflecting network attack vector, low complexity, and low privileges required.

Authenticated users can exploit the issue by submitting a specially crafted payload to the management interface, resulting in arbitrary command execution with impacts to confidentiality, integrity, and availability. The vulnerability description also notes that unauthenticated exploitation is possible through unspecified vectors.

Public references consist of a vulnerability disclosure write-up hosted on cryptnetix.com together with the vendor product page; no official patch details or mitigation steps are supplied in the available information. The associated EPSS score has remained flat at 0.1494 with no material increase observed after publication.

EU & UK References

Vulnerability details

The management portal component of JetNexus/EdgeNexus ADC 4.2.8 was discovered to contain a command injection vulnerability. This vulnerability allows authenticated attackers to execute arbitrary commands through a specially crafted payload. This vulnerability can also be exploited from an unauthenticated context…

more

via unspecified vectors

CWE(s)
CWE-78

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

edgenexus
application delivery controller
4.2.8

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SC-27 Platform-independent Applications
addresses: CWE-78

Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.

SI-10 Information Input Validation
addresses: CWE-78

Validates inputs to block special elements that would alter OS command execution.

References