CVE-2022-25369

An issue was discovered in Dynamicweb before 9.12.8. An attacker can add a new administrator user without authentication. This flaw exists due to a logic issue when determining if the setup phases of the product can be run again. Once an attacker is authenticated as the new admin user they have added, it is possible to upload an executable file and achieve command execution. This is fixed in 9.5.9, 9.6.16, 9.7.8, 9.8.11, 9.9.8, 9.10.18, 9.12.8, and 9.13.0 (and later).

• CWE-287
• CWE-288

• https://www.assetnote.io/resources/research/advisory-dynamicweb-logic-flaw-leading-to-rce-cve-2022-25369
• https://www.dynamicweb.com/resources/downloads?Category=Releases

Published

Jan 23, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-25361WatchGuard Firebox and XTM appliances allow an unauthenticat…9.1
• CVE-2022-25363WatchGuard Firebox and XTM appliances allow an authenticated…6.5
• CVE-2022-25364In Gradle Enterprise before 2021.4.2, the default built-in b…8.1
• CVE-2022-25365Docker Desktop before 4.5.1 on Windows allows attackers to m…7.8
• CVE-2022-25366Cryptomator through 1.6.5 allows DYLIB injection because, al…7.8
• CVE-2022-25368Spectre BHB is a variant of Spectre-v2 in which malicious co…4.7
• CVE-2022-2537The WooCommerce PDF Invoices & Packing Slips WordPress plugi…6.1
• CVE-2022-25370Apache OFBiz uses the Birt plugin (https://eclipse.github.io…5.4
• CVE-2022-25371Apache OFBiz uses the Birt project plugin (https://eclipse.g…9.8
• CVE-2022-25372Pritunl Client through 1.2.3019.52 on Windows allows local p…7.8
• CVE-2022-25373Zoho ManageEngine SupportCenter Plus before 11020 allows Sto…5.4
• CVE-2022-25374HashiCorp Terraform Enterprise v202112-1, v202112-2, v202201…7.5