CVE-2022-39033
CRITICALSmart eVision - Unauthenticated Path Traversal and Arbitrary File Deletion via URL Parameter
Title source: llmDescription
Smart eVision’s file acquisition function has a path traversal vulnerability due to insufficient filtering for special characters in the URL parameter. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication, access restricted paths to download and delete arbitrary system files to disrupt service.
References (1)
Core 1
Core References
Third Party Advisory x_refsource_misc
https://www.twcert.org.tw/tw/cp-132-6570-9c632-1.html
Scores
CVSS v3
9.8
EPSS
0.0149
EPSS Percentile
70.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
total
Details
CWE
CWE-22
Status
published
Products (1)
lcnet/smart_evision
2022.02.21
Published
Sep 28, 2022
Tracked Since
Feb 18, 2026