CVE-2022-45938
Published: 02 June 2023
Summary
CVE-2022-45938 is a critical-severity Cross-site Scripting (CWE-79) vulnerability in Xfinity Comcast Defined Technologies Microeisbss. Its CVSS base score is 9.0 (Critical).
Operationally, ranked in the top 4.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2022-45938 is a stored cross-site scripting vulnerability (CWE-79) discovered in Comcast Defined Technologies microeisbss through 2021. The flaw exists in the Device ID field of the Inventory Management component and carries a CVSS 3.1 base score of 9.0, reflecting a network attack vector, low attack complexity, and low-privileged access combined with required user interaction and changed scope.
An attacker who can supply a crafted Device ID value can store a malicious script that executes when the record is viewed by other users. Successful exploitation yields remote code execution and privilege escalation, allowing the attacker to compromise the confidentiality, integrity, and availability of the affected system.
The primary references point to Comcast’s Xfinity vulnerability reporting page and a technical write-up on Medium; these sources document the issue but do not enumerate specific patch versions or configuration mitigations in the supplied data. The associated EPSS scores (current 0.1683, peak 0.2108) remain moderate without a pronounced post-disclosure climb.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-48780
Vulnerability details
An issue was discovered in Comcast Defined Technologies microeisbss through 2021. An attacker can inject a stored XSS payload in the Device ID field under Inventory Management to achieve Remote Code Execution and privilege escalation..
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.