Device Manager Express

device_manager_express

Vendor: Audiocodes • 6 CVEs

CVEs (6)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2022-24632 1Audiocodes 1Device Manager Express Jun 17, 2026 May 29, 2023 N/A· v4 5.3 MEDIUM· v3 N/A· v2 An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is directory traversal during file download via the BrowseFiles.php view parameter.
CVE-2022-24631 1Audiocodes 1Device Manager Express Jun 17, 2026 May 29, 2023 N/A· v4 5.4 MEDIUM· v3 N/A· v2 An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is stored XSS via the ajaxTenants.php desc parameter.
CVE-2022-24630 1Audiocodes 1Device Manager Express Jun 17, 2026 May 29, 2023 N/A· v4 7.2 HIGH· v3 N/A· v2 An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. BrowseFiles.php allows a ?cmd=ssh POST request with an ssh_command field that is executed.
CVE-2022-24629 1Audiocodes 1Device Manager Express Jun 17, 2026 May 29, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. Remote code execution can be achieved via directory traversal in the dir parameter of the file upload functionality of BrowseFiles.php...Show more An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. Remote code execution can be achieved via directory traversal in the dir parameter of the file upload functionality of BrowseFiles.php. An attacker can upload a .php file to WebAdmin/admin/AudioCodes_files/ajax/.Show less
CVE-2022-24628 1Audiocodes 1Device Manager Express Jun 17, 2026 May 29, 2023 N/A· v4 7.2 HIGH· v3 N/A· v2 An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is authenticated SQL injection in the id parameter of IPPhoneFirmwareEdit.php.
CVE-2022-24627 1Audiocodes 1Device Manager Express Jun 17, 2026 May 29, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is an unauthenticated SQL injection in the p parameter of the process_login.php login form.