CVE-2022-0073

HIGHRansomware

Authenticated Remote Code Execution in OpenLiteSpeed Web Server

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2022-0073 has a selected CVSS score of 8.8 (high). VulnCheck reports CVE-2022-0073 use in known ransomware campaigns.

Description

Improper Input Validation vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server dashboards allows Command Injection. This affects 1.7.0 versions before 1.7.16.1.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Mar 19, 2025 · VulnCheck
Reported exploitation
Observed · VulnCheck
Ransomware use
Observed · VulnCheck

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated May 5, 2025 · Source: CVE List

Affected products and versions

3
ProductSourceVersion range

LiteSpeed Web Server

Browse LiteSpeed Technologies / LiteSpeed Web Server

Default status: unaffected

CVE List1.7.0 to < 1.7.16.1affected

OpenLiteSpeed Web Server

Browse LiteSpeed Technologies / OpenLiteSpeed Web Server

Default status: unaffected

CVE List1.7.0 to < 1.7.16.1affected

openlitespeed

Browse LiteSpeed Technologies / openlitespeed
VulnCheckVersion data not supplied

References

3