CVE-2022-35222
Last modified
CVE-2022-35222 is a medium-severity vulnerability rated 6.8/10 on the CVSS scale. HiCOS Citizen verification component has a stack-based buffer overflow vulnerability due to insufficient parameter length validation. An unauthenticated physical attacker can exploit this vulnerability to execute arbitrary code, manipulate system command or disrupt service.. EPSS estimates a 0.35% chance of exploitation in the next 30 days.
Description
HiCOS Citizen verification component has a stack-based buffer overflow vulnerability due to insufficient parameter length validation. An unauthenticated physical attacker can exploit this vulnerability to execute arbitrary code, manipulate system command or disrupt service.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Hinet | Hicos Natural Person Credential Component Client | 3.0.3.30306 |
| Hinet | Hicos Natural Person Credential Component Client | 3.0.3.30404 |
| Hinet | Hicos Natural Person Credential Component Client | 3.1.0.00002 |
References
- https://www.twcert.org.tw/tw/cp-132-6363-f5ec2-1.htmlThird Party Advisory
- https://www.twcert.org.tw/tw/cp-132-6363-f5ec2-1.htmlThird Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-35222?
How severe is CVE-2022-35222?
How do I fix CVE-2022-35222?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-35217The NHI card’s web service component has a stack-based buffe…7.8
- CVE-2022-35218The NHI card’s web service component has a heap-based buffer…5.5
- CVE-2022-35219The NHI card’s web service component has a stack-based buffe…5.5
- CVE-2022-3522Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2022-35220Teamplus Pro community discussion function has an ‘allocatio…6.5
- CVE-2022-35221Teamplus Pro community discussion has an ‘allocation of reso…5.4
- CVE-2022-35223EasyUse MailHunter Ultimate’s cookie deserialization functio…9.8
- CVE-2022-35224SAP Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.3…6.1
- CVE-2022-35225SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20,…6.1
- CVE-2022-35226SAP Data Services Management allows an attacker to copy the …6.1
- CVE-2022-35227A vulnerability in SAP NW EP (WPC) - versions 7.30, 7.31, 7.…6.1
- CVE-2022-35228SAP BusinessObjects CMC allows an unauthenticated attacker t…8.8
Are you affected by CVE-2022-35222?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST