CVE-2022-24581

7.5 highEPSS 1.0%

High (7.5) in aceware aceweb online portal. EPSS 1.0% chance of exploitation in the next 30 days.

ACEweb Online Portal 3.5.065 allows unauthenticated SMB hash capture via UNC. By specifying the UNC file path of an external SMB share when uploading a file, an attacker can induce the victim server to disclose the username and password hash of the user executing the ACEweb Online software.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 1.0% chance of exploitation in the next 30 days; higher than 62% of CVEs (scores of 2026-10-31)
CWE: CWE-434
Published: 2022-06-02
Modified: 2026-07-09
Record from: the NVD, synced 2026-10-19

Affected

aceware:aceweb_online_portal

References

https://www.aceware.com/forum/viewtopic.php?f=7&t=481
https://www.aceware.com/forum/viewtopic.php?f=7&t=481

Check your stack JSON