CVE-2022-24140

IOBit Advanced System Care 15, iTop Screen Recorder 2.1, iTop VPN 3.2, Driver Booster 9, and iTop Screenshot sends HTTP requests in their update procedure in order to download a config file. After downloading the config file, the products will parse the HTTP location of the update from the file and will try to install the update automatically with ADMIN privileges. An attacker Intercepting this communication can supply the product a fake config file with malicious locations for the updates thus gaining a remote code execution on an endpoint.

• CWE-494

• https://github.com/tomerpeled92/CVE/Third Party Advisory
• https://github.com/tomerpeled92/CVE/Third Party Advisory

Published

Jul 6, 2022

Last Modified

Jul 9, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-24132phpshe V1.8 is affected by a denial of service (DoS) attack …7.5
• CVE-2022-24135QingScan 1.3.0 is affected by Cross Site Scripting (XSS) vul…6.1
• CVE-2022-24136Hospital Management System v1.0 is affected by an unrestrict…9.8
• CVE-2022-24138IOBit Advanced System Care (Asc.exe) 15 and Action Download …7.8
• CVE-2022-24139In IOBit Advanced System Care (AscService.exe) 15, an attack…7.8
• CVE-2022-2414Access to external entities when parsing XML documents can l…7.5
• CVE-2022-24141The iTopVPNmini.exe component of iTop VPN 3.2 will try to co…5.4
• CVE-2022-24142Tenda AX3 v16.03.12.10_CN was discovered to contain a stack …7.5
• CVE-2022-24143Tenda AX3 v16.03.12.10_CN and AX12 22.03.01.2_CN was discove…7.5
• CVE-2022-24144Tenda AX3 v16.03.12.10_CN was discovered to contain a comman…9.8
• CVE-2022-24145Tenda AX3 v16.03.12.10_CN was discovered to contain a stack …7.5
• CVE-2022-24146Tenda AX3 v16.03.12.10_CN was discovered to contain a stack …7.5