Is CVE-2022-0138 actively exploited?

No active exploitation of CVE-2022-0138 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2022-0138 be exploited remotely?

Yes. CVE-2022-0138 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2022-0138?

CVE-2022-0138 has a CVSS score of 7.5 (HIGH).

HOME VULNERABILITIESCVE-2022-0138

HIGH

CVE-2022-0138

CWE-502Published: February 18, 2022· Updated: Jun 17, 2026

7.5

CVSS v3.1

Official Description

MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 has a deserialization function that does not validate or check the data, allowing arbitrary classes to be created.

NVD Source

Technical Analysis

CVE-2022-0138 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in full integrity compromise (data manipulation), with a CVSS base score of 7.5.

From a weakness classification perspective (CWE-502): Insecure deserialization vulnerabilities allow attackers to inject malicious objects during deserialization, potentially enabling remote code execution.