High severity · published Jun 6, 2022
CVE-2022-27438
Caphyon Ltd Advanced Installer 19.3 and earlier and many products that use the updater from Advanced Installer (Advanced Updater) are affected by a remote code execution…
8.1
CVSS
2.1%
EPSS
No
On KEV
Description
Caphyon Ltd Advanced Installer 19.3 and earlier and many products that use the updater from Advanced Installer (Advanced Updater) are affected by a remote code execution vulnerability via the CustomDetection parameter in the update check function. To exploit this vulnerability, a user must start an affected installation to trigger the update check.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
Advanced Installer · Caphyon
before 19.4 · source: NVD
AB
Angry Birds Space · Rovio
1.4.1 · source: NVD
AP
Archive Password Recovery · Krylack
3.70.69 · source: NVD
AP
Asterisks Password Decryptor · Krylack
3.31.107 · source: NVD
BP
Bad Piggies · Rovio
1.3.0 · source: NVD
BE
Better Explorer · Gainedge
2020.3.15.1304 · source: NVD
BS
Boomtv Streamer Portal · Boom
2.2.1 · source: NVD
BS
Burning Suite · Krylack
1.20.05 · source: NVD
CF
Call Flow Designer · 3cx
18.2.13 · source: NVD
CT
Crm Template Generator · 3cx
2.1.23 · source: NVD
DF
Direct Folders · Codesector
4.0 · source: NVD
DU
Displaylink Usb Graphics · Synaptics
before 10.3.6400.0 · source: NVD