CVE-2022-24629

9.8 criticalEPSS 37%

Critical (9.8) in audiocodes device manager express. EPSS 37% chance of exploitation in the next 30 days.

An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. Remote code execution can be achieved via directory traversal in the dir parameter of the file upload functionality of BrowseFiles.php. An attacker can upload a .php file to WebAdmin/admin/AudioCodes_files/ajax/.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 37% chance of exploitation in the next 30 days; higher than 98% of CVEs (scores of 2026-10-31)
CWE: CWE-22
Published: 2023-05-29
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

audiocodes:device_manager_express

References

http://seclists.org/fulldisclosure/2023/Feb/12
http://seclists.org/fulldisclosure/2023/Feb/12

Check your stack JSON