PT-2022-16393 · Unknown · Xcom Data Transport

Published 2022-02-14 · Updated 2023-08-08 · CVE-2022-23992

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions XCOM Data Transport for Windows, Linux, and UNIX version 11.6

Description The issue is due to insufficient input validation, which could potentially allow remote attackers to execute arbitrary commands with elevated privileges.

Recommendations For XCOM Data Transport for Windows, Linux, and UNIX version 11.6, update to a version that includes input validation to prevent remote attackers from executing arbitrary commands with elevated privileges.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2022-23992

Affected Products

Xcom Data Transport

References · 5

• https://osv.dev/vulnerability/CVE-2022-23992 · Vendor Advisory
• https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/XCOM-Data-Transport---Windows-and-XCOM-Data-Transport--Linux--UNIX-Vulnerability-CVE-2022-23992/18750 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23992 · Security Note
• https://t.me/cvenotify/26778 · Telegram Post
• https://t.me/cibsecurity/37460 · Telegram Post