{"api_version":"1","generated_at":"2026-07-23T10:33:03+00:00","cve":"CVE-2022-23764","urls":{"html":"https://cve.report/CVE-2022-23764","api":"https://cve.report/api/cve/CVE-2022-23764.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2022-23764","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2022-23764"},"summary":{"title":"CVE-2022-23764","description":"The vulnerability causing from insufficient verification procedures for downloaded files during WebCube update. Remote attackers can bypass this verification logic to update both digitally signed and unauthorized files, enabling remote code execution.","state":"PUBLIC","assigner":"vuln@krcert.or.kr","published_at":"2022-08-17 21:15:00","updated_at":"2022-08-19 12:47:00"},"problem_types":["CWE-346"],"metrics":[],"references":[{"url":"https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66876","name":"https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66876","refsource":"MISC","tags":[],"title":"Security Advisory | KrCERT/CC - KISA 인터넷 보호나라&KrCERT","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-23764","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23764","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2022","cve_id":"23764","vulnerable":"-1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"microsoft","cpe5":"windows","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2022","cve_id":"23764","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"teruten","cpe5":"webcube","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"vuln@krcert.or.kr","ID":"CVE-2022-23764","STATE":"PUBLIC","TITLE":"TERUTEN WebCube update remote code execution vulnerability"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"WebCube","version":{"version_data":[{"platform":"Windows","version_affected":"<","version_name":"1.0.5.5","version_value":"1.2.0.0"}]}}]},"vendor_name":"TERUTEN Co.,Ltd"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The vulnerability causing from insufficient verification procedures for downloaded files during WebCube update. Remote attackers can bypass this verification logic to update both digitally signed and unauthorized files, enabling remote code execution."}]},"generator":{"engine":"Vulnogram 0.0.9"},"impact":{"cvss":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-346 Origin Validation Error"}]}]},"references":{"reference_data":[{"refsource":"MISC","url":"https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66876","name":"https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66876"}]},"source":{"discovery":"UNKNOWN"}},"nvd":{"publishedDate":"2022-08-17 21:15:00","lastModifiedDate":"2022-08-19 12:47:00","problem_types":["CWE-346"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL"},"exploitabilityScore":3.9,"impactScore":5.9}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"AND","children":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:teruten:webcube:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.5.5","versionEndExcluding":"1.2.0.0","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":false,"cpe23Uri":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","cpe_name":[]}]}],"cpe_match":[]}]}},"legacy_mitre":{"record":{"CveYear":"2022","CveId":"23764","Ordinal":"226626","Title":"CVE-2022-23764","CVE":"CVE-2022-23764","Year":"2022"},"notes":[{"CveYear":"2022","CveId":"23764","Ordinal":"1","NoteData":"** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.","Type":"Description","Title":null}]}}}