{"id":"CVE-2022-26669","state":"PUBLISHED","title":"ASUS Control Center - SQL Injection","description":"ASUS Control Center is vulnerable to SQL injection. An authenticated remote attacker with general user privilege can inject SQL command to specific API parameters to acquire database schema or access data.","publishedAt":"2022-06-20T05:30:31.029Z","updatedAt":"2024-09-17T02:42:16.801Z","severity":{"score":8.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"twcert"},"assigner":"twcert","products":["ASUS Control Center"],"affected":[{"vendor":"ASUS","product":"Control Center","versions":[{"version":"1.4.2.5","status":"affected"}]}],"references":["https://www.twcert.org.tw/tw/cp-132-6056-b0d90-1.html"],"weaknesses":["CWE-89"],"ingestedAt":"2026-10-29T19:49:49.689Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/26xxx/CVE-2022-26669.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2022-26669","state":"PUBLISHED","datePublished":"2022-06-20T05:30:31.029Z","dateUpdated":"2024-09-17T02:42:16.801Z","assignerShortName":"twcert","assignerOrgId":"cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e","dateReserved":"2022-03-08T00:00:00.000Z"},"containers":{"cna":{"title":"ASUS Control Center - SQL Injection","descriptions":[{"lang":"en","value":"ASUS Control Center is vulnerable to SQL injection. An authenticated remote attacker with general user privilege can inject SQL command to specific API parameters to acquire database schema or access data."}],"affected":[{"vendor":"ASUS","product":"Control Center","versions":[{"version":"1.4.2.5","status":"affected"}]}],"references":[{"url":"https://www.twcert.org.tw/tw/cp-132-6056-b0d90-1.html","tags":["x_refsource_MISC"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-89","description":"CWE-89 SQL Injection","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"twcert","dateUpdated":"2022-06-20T05:30:30.000Z","orgId":"cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e"},"datePublic":"2022-04-26T00:00:00.000Z","solutions":[{"lang":"en","value":"Update version to 1.4.3.2"}],"source":{"advisory":"TVN-202203002","discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.0.9"},"x_legacyV4Record":{"CVE_data_meta":{"AKA":"TWCERT/CC","ASSIGNER":"cve@cert.org.tw","DATE_PUBLIC":"2022-04-26T05:10:00.000Z","ID":"CVE-2022-26669","STATE":"PUBLIC","TITLE":"ASUS Control Center - SQL Injection"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Control Center","version":{"version_data":[{"version_affected":"=","version_value":"1.4.2.5"}]}}]},"vendor_name":"ASUS"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"ASUS Control Center is vulnerable to SQL injection. An authenticated remote attacker with general user privilege can inject SQL command to specific API parameters to acquire database schema or access data."}]},"generator":{"engine":"Vulnogram 0.0.9"},"impact":{"cvss":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-89 SQL Injection"}]}]},"references":{"reference_data":[{"name":"https://www.twcert.org.tw/tw/cp-132-6056-b0d90-1.html","refsource":"MISC","url":"https://www.twcert.org.tw/tw/cp-132-6056-b0d90-1.html"}]},"solution":[{"lang":"en","value":"Update version to 1.4.3.2"}],"source":{"advisory":"TVN-202203002","discovery":"EXTERNAL"}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.twcert.org.tw/tw/cp-132-6056-b0d90-1.html","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-03T05:11:44.296Z"}}]}}}