{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "All version prior to 4.18.0"}]}], "descriptions": [{"lang": "en", "value": "AXIS IP Utility before 4.18.0 allows for remote code execution and local privilege escalation by the means of DLL hijacking. IPUtility.exe would attempt to load DLLs from its current working directory which could allow for remote code execution if a compromised DLL would be placed in the same folder."}], "problemTypes": [{"descriptions": [{"description": "Remote code execution and local privilege escalation by the means of DLL hijacking", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2022-03-09T14:54:30", "orgId": "f2daf9a0-02c2-4b83-a01d-63b3b304b807", "shortName": "Axis"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.axis.com/files/tech_notes/CVE-2022-23410.pdf"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "product-security@axis.com", "ID": "CVE-2022-23410", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "All version prior to 4.18.0"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "AXIS IP Utility before 4.18.0 allows for remote code execution and local privilege escalation by the means of DLL hijacking. IPUtility.exe would attempt to load DLLs from its current working directory which could allow for remote code execution if a compromised DLL would be placed in the same folder."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Remote code execution and local privilege escalation by the means of DLL hijacking"}]}]}, "references": {"reference_data": [{"name": "https://www.axis.com/files/tech_notes/CVE-2022-23410.pdf", "refsource": "MISC", "url": "https://www.axis.com/files/tech_notes/CVE-2022-23410.pdf"}]}}}}, "cveMetadata": {"assignerOrgId": "f2daf9a0-02c2-4b83-a01d-63b3b304b807", "assignerShortName": "Axis", "cveId": "CVE-2022-23410", "datePublished": "2022-02-14T21:04:28", "dateReserved": "2022-01-18T00:00:00", "dateUpdated": "2022-03-09T14:54:30", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:axis:ip_utility:*:*:*:*:*:*:*:*", "matchCriteriaId": "43623E9A-89A3-4DD5-867F-D361EB2E9187", "versionEndExcluding": "4.18.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "AXIS IP Utility before 4.18.0 allows for remote code execution and local privilege escalation by the means of DLL hijacking. IPUtility.exe would attempt to load DLLs from its current working directory which could allow for remote code execution if a compromised DLL would be placed in the same folder."}, {"lang": "es", "value": "AXIS IP Utility antes de la versi\u00f3n 4.18.0 permite la ejecuci\u00f3n remota de c\u00f3digo y el aumento de privilegios locales mediante el secuestro de DLL. IPUtility.exe intentaba cargar DLLs desde su directorio de trabajo actual, lo que pod\u00eda permitir la ejecuci\u00f3n remota de c\u00f3digo si se colocaba una DLL comprometida en la misma carpeta"}], "id": "CVE-2022-23410", "lastModified": "2022-05-11T14:23:54.003", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.4, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.4, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-02-14T22:15:08.147", "references": [{"source": "product-security@axis.com", "tags": ["Vendor Advisory"], "url": "https://www.axis.com/files/tech_notes/CVE-2022-23410.pdf"}], "sourceIdentifier": "product-security@axis.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-427"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}