CVE-2022-38120 MEDIUM

CVE-2022-38120: POWERCOM CO., LTD. UPSMON PRO - Path Traversal

Vendor Powercom Co., Ltd.

Product UPSMON PRO

Weakness CWE-22 · Path traversal

Published November 10, 2022

Last update May 1, 2025

View on NVD All CVEs

CVSS base score

6.5/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality High

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

UPSMON PRO’s has a path traversal vulnerability. A remote attacker with general user privilege can exploit this vulnerability to bypass authentication and access arbitrary system files.

Key dates

02Disclosure timeline

November 10, 2022 CVE published

May 1, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-38120 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/22.html

Related vulnerabilities

04Related CVE

CVE-2026-50003 OFFIS DCMTK Toolkit Path Traversal CVE-2026-44017 Docling: Unsafe Zip Extraction in EasyOCR Model Download CVE-2026-49991 RustFS Snowball Auto-Extract: Path Traversal allows cross-bucket object injection CVE-2026-9725 Printcart Web to Print Product Designer for WooCommerce <= 2.5.2 - Unauthenticated Arbitrary File Deletion CVE-2026-47897 Apache Lucene.Net: Arbitrary file write from malicious server to Lucene.Net.Replicator client