Is CVE-2022-24552 actively exploited?

No active exploitation of CVE-2022-24552 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2022-24552 be exploited remotely?

Yes. CVE-2022-24552 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2022-24552?

CVE-2022-24552 has a CVSS score of 9.8 (CRITICAL).

HOME VULNERABILITIESCVE-2022-24552

CRITICAL

CVE-2022-24552

CWE-78Published: February 6, 2022· Updated: Jun 17, 2026

9.8

CVSS v3.1

Official Description

A flaw was found in the REST API in StarWind Stack. REST command, which manipulates a virtual disk, doesn’t check input parameters. Some of them go directly to bash as part of a script. An attacker with non-root user access can inject arbitrary data into the command that will be executed with root privileges. This affects StarWind SAN and NAS v0.2 build 1633.

NVD Source

Technical Analysis

CVE-2022-24552 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 9.8.