CVE-2022-44794

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-11-07 · updated 2026-06-17
Weakness: CWE-94

Description

An issue was discovered in Object First Ootbi BETA build 1.0.7.712. Management protocol has a flow which allows a remote attacker to execute arbitrary Bash code with root privileges. The command that sets the hostname doesn't validate input parameters. As a result, arbitrary data goes directly to the Bash interpreter. An attacker would need credentials to exploit this vulnerability. This is fixed in Object First Ootbi BETA build 1.0.13.1611.

Affected products

Objectfirst Ootbi: before 1.0.13.1611 — fixed in 1.0.13.1611

How to fix

Upgrade to a fixed version: Objectfirst Ootbi 1.0.13.1611. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-44794 or the next vulnerability affects your stack