CVE-2022-24140: iobit advanced system care +4 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2022-24140

CVSS 6.6 · Medium EPSS 0,71%

Kerentanan Download of Code Without Integrity Check pada iobit advanced system care, iobit driver booster +3 lainnya. Skor CVSS 3.1 6.6 (Medium) menurut NVD.

Deskripsi (NVD)

IOBit Advanced System Care 15, iTop Screen Recorder 2.1, iTop VPN 3.2, Driver Booster 9, and iTop Screenshot sends HTTP requests in their update procedure in order to download a config file. After downloading the config file, the products will parse the HTTP location of the update from the file and will try to install the update automatically with ADMIN privileges. An attacker Intercepting this communication can supply the product a fake config file with malicious locations for the updates thus gaining a remote code execution on an endpoint.

Rincian

Terbit di NVD: 6 Juli 2022
Terakhir diubah: 9 Juli 2026
Status NVD: Modified
CVSS 3.1: 6.6 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-494: Download of Code Without Integrity Check
EPSS (30 hari): 0,71% peluang dieksploitasi; lebih tinggi dari 52,3% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
iobit	advanced system care	Versi 15
iobit	driver booster	Versi 9
iobit	itop screen recorder	Versi 2.1
iobit	itop screenshot	Semua versi
iobit	itop vpn	Versi 3.2

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/tomerpeled92/CVE/ advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.