{"id":"CVE-2022-24629","url":"https://www.cyber-defence.io/tools/cve/CVE-2022-24629","generatedAt":"2026-11-04T23:23:37.483Z","title":"Remote code execution can be achieved via directory traversal in the dir parameter of the file upload functionality of BrowseFiles.php.","description":"An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. Remote code execution can be achieved via directory traversal in the dir parameter of the file upload functionality of BrowseFiles.php. An attacker can upload a .php file to WebAdmin/admin/AudioCodes_files/ajax/.","published":"2023-05-29T21:15:10.000Z","lastModified":"2026-06-17T04:32:13.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"3.1","score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-22"],"affected":["audiocodes/device manager express"],"epss":{"score":0.37246,"percentile":0.98526,"date":"2026-11-03","history":[]},"kev":{"listed":false},"exploits":{"count":1,"verified":false,"firstPublished":"2023-03-30","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":51145,"kind":"exploit","title":"Device Manager Express 7.8.20002.47752 - Remote Code Execution (RCE)","url":"https://www.exploit-db.com/exploits/51145","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/51145.py","file":"exploits/php/webapps/51145.py","published":"2023-03-30","added":"2023-03-30","updated":"2023-03-30","author":"Eric Flokstra","type":"webapps","platform":"php","port":null,"verified":false,"codes":["CVE-2022-24632","CVE-2022-24630","CVE-2022-24629","CVE-2022-24627"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":null}]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 37.2%, higher than 99% of all known CVEs. Patch or mitigate before the next change window."},"changes":[],"references":[{"url":"http://seclists.org/fulldisclosure/2023/Feb/12","tags":["Exploit","Mailing List","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://seclists.org/fulldisclosure/2023/Feb/12","tags":["Exploit","Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2022-24629","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}