CVE-2022-46304

ChangingTec ServiSign - Command Injection

State: Published
Severity: 8.8 High
Published: Jan 3, 2023
Updated: Apr 10, 2025
Reserved: Nov 29, 2022

Description

ChangingTec ServiSign component has insufficient filtering for special characters in the connection response parameter. An unauthenticated remote attacker can host a malicious website for the component user to access, which triggers command injection and allows the attacker to execute arbitrary system command to perform arbitrary system operation or disrupt service.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	twcert

Weaknesses

CWE-78 OS Command Injection

Affected Products

Product	Versions
ServiSignChangingTec	0Unknown

References

https://www.twcert.org.tw/tw/cp-132-6800-b5cf6-1.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.