CVE-2022-24627
📋 TL;DR
CVE-2022-24627 is an unauthenticated SQL injection vulnerability in AudioCodes Device Manager Express login form. Attackers can execute arbitrary SQL commands without credentials, potentially compromising the entire system. Organizations using AudioCodes Device Manager Express versions through 7.8.20002.47752 are affected.
💻 Affected Systems
- AudioCodes Device Manager Express
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise including remote code execution, data exfiltration, and persistent backdoor installation leading to full network compromise.
Likely Case
Database compromise, credential theft, privilege escalation, and potential lateral movement within the network.
If Mitigated
Limited impact with proper network segmentation, WAF protection, and intrusion detection systems blocking SQL injection attempts.
🎯 Exploit Status
Public disclosure includes technical details making exploitation straightforward for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 7.8.20002.47752
Vendor Advisory: https://www.audiocodes.com/support/security-advisories
Restart Required: Yes
Instructions:
1. Check current version using admin interface. 2. Download latest version from AudioCodes support portal. 3. Backup configuration. 4. Apply update following vendor documentation. 5. Restart services. 6. Verify update successful.
🔧 Temporary Workarounds
Network Access Restriction
linuxRestrict access to Device Manager Express to trusted IP addresses only
iptables -A INPUT -p tcp --dport [PORT] -s [TRUSTED_IP] -j ACCEPT
iptables -A INPUT -p tcp --dport [PORT] -j DROP
Web Application Firewall
allDeploy WAF with SQL injection protection rules
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Device Manager Express from critical systems
- Deploy intrusion detection/prevention systems with SQL injection signatures monitoring the login endpoint
🔍 How to Verify
Check if Vulnerable:
Check version in admin interface or via web request to /process_login.php with SQL injection test payloads (use caution).Check Version:
Check web interface or contact AudioCodes support for version verificationVerify Fix Applied:
Verify version is above 7.8.20002.47752 and test that SQL injection attempts no longer succeed.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in application logs
- Multiple failed login attempts with SQL syntax
- Database connection errors
Network Indicators:
- HTTP POST requests to /process_login.php containing SQL keywords
- Unusual database traffic from web server
SIEM Query:
source="web_logs" AND uri="/process_login.php" AND (payload CONTAINS "UNION" OR payload CONTAINS "SELECT" OR payload CONTAINS "OR 1=1")