CVE-2022-23770: WISA Smart Wing CMS Remote Command Execution Vulnerability

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-10-17 · updated 2026-06-17
Weakness: CWE-20

Description

This vulnerability could allow a remote attacker to execute remote commands with improper validation of parameters of certain API constructors. Remote attackers could use this vulnerability to execute malicious commands such as directory traversal.

Affected products

WISA corp. Smart Wing CMS: before 19051 — fixed in 19051

How to fix

Upgrade to a fixed version: WISA corp. Smart Wing CMS 19051. Check the vendor advisory for mitigations.

References

https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66963
https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66963

Get alerted when CVE-2022-23770 or the next vulnerability affects your stack