Exploitation Summary
EIP tracks 2 public exploits for CVE-2022-28944. PoCs published by gar-re.
AI-analyzed exploit summary This PoC exploits an unauthenticated update mechanism in EMCO Software products by spoofing the update server and serving a malicious executable. The attack leverages DNS spoofing and a self-signed certificate to deliver a payload that executes arbitrary commands.
Description
Certain EMCO Software products are affected by: CWE-494: Download of Code Without Integrity Check. This affects MSI Package Builder for Windows 9.1.4 and Remote Installer for Windows 6.0.13 and Ping Monitor for Windows 8.0.18 and Remote Shutdown for Windows 7.2.2 and WakeOnLan 2.0.8 and Network Inventory for Windows 5.8.22 and Network Software Scanner for Windows 2.0.8 and UnLock IT for Windows 6.1.1. The impact is: execute arbitrary code (remote). The component is: Updater. The attack vector is: To exploit this vulnerability, a user must trigger an update of an affected installation of EMCO Software. ¶¶ Multiple products from EMCO Software are affected by a remote code execution vulnerability during the update process.
Exploits (2)
This PoC exploits an unauthenticated update mechanism in EMCO Software products by spoofing the update server and serving a malicious executable. The attack leverages DNS spoofing and a self-signed certificate to deliver a payload that executes arbitrary commands.
This repository contains a functional proof-of-concept exploit for CVE-2022-28944, which targets EMCO Software products via unauthenticated update mechanisms. The exploit involves DNS spoofing to redirect update requests to an attacker-controlled server, serving a malicious update payload (proof.exe) that executes arbitrary commands.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H