CVE-2022-25226

🗓️ 18 Apr 2022 16:20:44Reported by Fluid AttacksType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 96 Views🌐 WEB

ThinVNC 1.0b1 allows unauthenticated user to bypass authentication, leading to code execution

Reporter	Title	Published	Views	Family All 11
ATTACKERKB	CVE-2022-25226	18 Apr 202217:15	–	attackerkb
GithubExploit	Exploit for CVE-2022-25226	16 Jul 202502:56	–	githubexploit
Circl	CVE-2022-25226	18 Apr 202220:29	–	circl
CNNVD	ThinVNC 安全漏洞	18 Apr 202200:00	–	cnnvd
Cvelist	CVE-2022-25226	18 Apr 202216:20	–	cvelist
Nuclei	ThinVNC - Authentication Bypass	6 Jun 202603:01	–	nuclei
NVD	CVE-2022-25226	18 Apr 202217:15	–	nvd
OSV	CVE-2022-25226	18 Apr 202217:15	–	osv
Prion	Authentication flaw	18 Apr 202217:15	–	prion
Positive Technologies	PT-2022-17165 · Thinvnc · Thinvnc	18 Apr 202200:00	–	ptsecurity

NVD

Node

cybelsoft thinvncMatch1.0b1

[
  {
    "product": "ThinVNC",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "1.0b1"
      }
    ]
  }
]

Source	Link
fluidattacks	www.fluidattacks.com/advisories/sinatra/

Parameter	Position	Path	Description	CWE
cmd	query param	/cmd?cmd=connect	Authentication bypass via /cmd endpoint enabling unauthenticated access
cmd	query param	/cmd?cmd=start	Start command on authenticated session via /cmd endpoint enabling mouse/keyboard control

21 Nov 2024 06:51Current

9.8High risk

Vulners AI Score9.8

CVSS 27.5

CVSS 3.110

EPSS0.81886