{"id":"CVE-2022-23764","state":"PUBLISHED","title":"TERUTEN WebCube update remote code execution vulnerability","description":"The vulnerability causing from insufficient verification procedures for downloaded files during WebCube update. Remote attackers can bypass this verification logic to update both digitally signed and unauthorized files, enabling remote code execution.","publishedAt":"2022-08-17T20:23:03.000Z","updatedAt":"2024-08-03T03:51:46.048Z","severity":{"score":8.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"krcert"},"assigner":"krcert","products":["TERUTEN Co.,Ltd WebCube"],"affected":[{"vendor":"TERUTEN Co.,Ltd","product":"WebCube","versions":[{"version":"1.0.5.5","status":"affected","lessThan":"1.2.0.0","versionType":"custom"}],"platforms":["Windows"]}],"references":["https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66876"],"weaknesses":["CWE-346"],"ingestedAt":"2026-10-29T19:49:40.939Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/23xxx/CVE-2022-23764.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2022-23764","state":"PUBLISHED","datePublished":"2022-08-17T20:23:03.000Z","dateUpdated":"2024-08-03T03:51:46.048Z","assignerShortName":"krcert","assignerOrgId":"cdd7a122-0fae-4202-8d86-14efbacc2863","dateReserved":"2022-01-19T00:00:00.000Z"},"containers":{"cna":{"title":"TERUTEN WebCube update remote code execution vulnerability","descriptions":[{"lang":"en","value":"The vulnerability causing from insufficient verification procedures for downloaded files during WebCube update. Remote attackers can bypass this verification logic to update both digitally signed and unauthorized files, enabling remote code execution."}],"affected":[{"vendor":"TERUTEN Co.,Ltd","product":"WebCube","versions":[{"version":"1.0.5.5","status":"affected","lessThan":"1.2.0.0","versionType":"custom"}],"platforms":["Windows"]}],"references":[{"url":"https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66876","tags":["x_refsource_MISC"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-346","description":"CWE-346 Origin Validation Error","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"krcert","dateUpdated":"2022-08-17T20:23:03.000Z","orgId":"cdd7a122-0fae-4202-8d86-14efbacc2863"},"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.0.9"},"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"vuln@krcert.or.kr","ID":"CVE-2022-23764","STATE":"PUBLIC","TITLE":"TERUTEN WebCube update remote code execution vulnerability"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"WebCube","version":{"version_data":[{"platform":"Windows","version_affected":"<","version_name":"1.0.5.5","version_value":"1.2.0.0"}]}}]},"vendor_name":"TERUTEN Co.,Ltd"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The vulnerability causing from insufficient verification procedures for downloaded files during WebCube update. Remote attackers can bypass this verification logic to update both digitally signed and unauthorized files, enabling remote code execution."}]},"generator":{"engine":"Vulnogram 0.0.9"},"impact":{"cvss":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-346 Origin Validation Error"}]}]},"references":{"reference_data":[{"name":"https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66876","refsource":"MISC","url":"https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66876"}]},"source":{"discovery":"UNKNOWN"}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66876","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-03T03:51:46.048Z"}}]}}}