CVE-2022-24627

CRITICAL NUCLEI

AudioCodes Device Manager Express <7.8.20002.47752 - SQL Injection

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2022-24627. A Nuclei detection template is also available.

AI-analyzed exploit summary This Python script exploits multiple vulnerabilities in AudioCodes Device Manager Express (CVE-2022-24627, CVE-2022-24629, CVE-2022-24630, CVE-2022-24632) to achieve remote code execution, file upload/download, and command execution via SQL injection, path traversal, and authentication bypass.

Description

An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is an unauthenticated SQL injection in the p parameter of the process_login.php login form.

Exploits (1)

exploitdb WORKING POC
pythonwebappsphp
https://www.exploit-db.com/exploits/51145

This Python script exploits multiple vulnerabilities in AudioCodes Device Manager Express (CVE-2022-24627, CVE-2022-24629, CVE-2022-24630, CVE-2022-24632) to achieve remote code execution, file upload/download, and command execution via SQL injection, path traversal, and authentication bypass.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: AudioCodes Device Manager Express <= 7.8.20002.47752
No auth needed
Prerequisites: Network access to the target · Default or bypassable credentials
devstral-2 · analyzed Feb 19, 2026 Full analysis →

Nuclei Templates (1)

AudioCodes Device Manager Express - SQL Injection
CRITICALVERIFIEDby geeknik
Shodan: title:"Audiocodes" || http.title:"audiocodes"
FOFA: title="audiocodes"

References (1)

Core 1
Core References
Exploit, Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2023/Feb/12

Scores

CVSS v3 9.8
EPSS 0.2639
EPSS Percentile 97.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-89
Status published
Products (1)
audiocodes/device_manager_express < 7.8.20002.47752
Published May 29, 2023
Tracked Since Feb 18, 2026