CVE-2022-23862

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-10-22 · updated 2026-06-17
Weakness: CWE-306

Description

A Local Privilege Escalation issue was discovered in Y Soft SAFEQ 6 Build 53. The SafeQ JMX service running on port 9696 is vulnerable to JMX MLet attacks. Because the service did not enforce authentication and was running under the "NT Authority\System" user, an attacker is able to use the vulnerability to execute arbitrary code and elevate to the system user.

Affected products

YSoft Safeq: 6.0-build53

References

https://github.com/mbadanoiu/CVE-2022-23862
https://github.com/mbadanoiu/CVE-2022-23862/blob/main/SafeQ%20-%20CVE-2022-23862.pdf
https://ysoft.com

Get alerted when CVE-2022-23862 or the next vulnerability affects your stack