CVE-2022-23767
CWE-22Published: September 19, 2022· Updated: Jun 17, 2026
Official Description
This vulnerability of SecureGate is SQL-Injection using login without password. A path traversal vulnerability is also identified during file transfer. An attacker can take advantage of these vulnerabilities to perform various attacks such as obtaining privileges and executing remote code, thereby taking over the victim’s system.
Risk Analysis
SecureGate is vulnerable to SQL injection that allows login without a password, as well as path traversal during file transfers. These flaws allow an attacker to gain privileges and execute remote code, leading to a full system compromise.
There is no known public exploit for this issue, and it is not listed in the CISA KEV catalog.
Apply the latest security patches provided by the vendor for SecureGate and Weblink.
Technical Analysis
CVE-2022-23767 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.
The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.
A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 9.8.
CVSS v3.1 Vector Breakdown
Affected Vendors & Products
Exploit & PoC Resources
Official Patches & Advisories
All References (2)
Quick Facts
Related CVEs (CWE-22)
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2022-23767 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts