PT-2022-18781 · Vandyke · Vshell For Windows

Published 2022-05-02 · Updated 2023-08-08 · CVE-2022-28054

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions VanDyke Software VShell for Windows version 4.6.2

Description The issue is related to improper sanitization of trigger action scripts, allowing attackers to execute arbitrary code via a crafted value.

Recommendations For VanDyke Software VShell for Windows version 4.6.2, update to a version that addresses the improper sanitization of trigger action scripts to prevent the execution of arbitrary code.

Fix

Related Identifiers

CVE-2022-28054

Affected Products

Vshell For Windows

References · 4

• https://vandyke.com/support/advisory/2022/02/remote-execution-via-triggers.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-28054 · Security Note
• https://osv.dev/vulnerability/CVE-2022-28054 · Vendor Advisory
• https://t.me/cibsecurity/41724 · Telegram Post