CVE-2022-40022

Deeper analysis

Microchip Technology (Microsemi) SyncServer S650 contains a command injection vulnerability tracked as CVE-2022-40022 and assigned CWE-77. The flaw received a CVSS 3.1 score of 9.8, reflecting network attack vector, low attack complexity, and no requirements for authentication or user interaction. The affected device is a network time server used for precise timing and synchronization in enterprise and telecommunications environments.

Unauthenticated remote attackers can exploit the issue over the network to inject and execute arbitrary operating-system commands. Successful exploitation grants full control over the device, enabling complete compromise of confidentiality, integrity, and availability without any prior credentials or user assistance.

Public references include an exploit proof-of-concept published on Packet Storm and a detailed advisory on Securifera, confirming unauthenticated remote command execution is achievable. The EPSS score currently stands at 0.9078 with a recorded peak of 0.9084, indicating sustained high exploitation probability since disclosure. No vendor patch or mitigation guidance is described in the supplied references.