CVE-2022-46404
Published: 13 December 2022
Summary
CVE-2022-46404 is a critical-severity Command Injection (CWE-77) vulnerability in Atos Unify Openscape 4000 Assistant. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 6.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2022-46404 is a command injection vulnerability, tracked under CWE-77, that affects Atos Unify OpenScape 4000 Assistant and Unify OpenScape 4000 Manager in versions 8 before R2.22.18, 10 before 0.28.13, and 10 R1 before R1.34.4. The flaw carries a CVSS 3.1 base score of 9.8 with a network attack vector, low complexity, and no required privileges or user interaction.
An unauthenticated remote attacker can exploit the issue to upload arbitrary files and obtain administrative access to the affected system. The vulnerability permits full compromise of confidentiality, integrity, and availability without authentication.
Vendor advisory OBSO-2211-02, published by Unify, details the affected releases and directs customers to apply the fixed versions R2.22.18, 0.28.13, or R1.34.4. The same guidance is referenced in contemporaneous reporting from heise.de.
EPSS remains at 0.1091 with no material increase from its initial value.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-49213
Vulnerability details
A command injection vulnerability has been identified in Atos Unify OpenScape 4000 Assistant and Unify OpenScape 4000 Manager (8 before R2.22.18, 10 before 0.28.13, and 10 R1 before R1.34.4) that may allow an unauthenticated attacker to upload arbitrary files and…
more
achieve administrative access to the system.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.