CVE-2022-25369

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 39.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-01-23 · updated 2026-06-17
Weakness: CWE-287

Description

An issue was discovered in Dynamicweb before 9.12.8. An attacker can add a new administrator user without authentication. This flaw exists due to a logic issue when determining if the setup phases of the product can be run again. Once an attacker is authenticated as the new admin user they have added, it is possible to upload an executable file and achieve command execution. This is fixed in 9.5.9, 9.6.16, 9.7.8, 9.8.11, 9.9.8, 9.10.18, 9.12.8, and 9.13.0 (and later).

References

https://www.assetnote.io/resources/research/advisory-dynamicweb-logic-flaw-leading-to-rce-cve-2022-25369
https://www.dynamicweb.com/resources/downloads?Category=Releases

Get alerted when CVE-2022-25369 or the next vulnerability affects your stack