CVE-2022-36784 - Elsight – Elsight Halo Remote Code Execution (RCE) · CoreCVE

Back Back to CVE browser

CRITICAL

Elsight – Elsight Halo Remote Code Execution (RCE)

Published Nov 17, 2022

9.8

CRITICAL

CVSS 3.1

EPSS 1.14%

Description

Elsight – Elsight Halo Remote Code Execution (RCE) Elsight Halo web panel allows us to perform connection validation. through the POST request : /api/v1/nics/wifi/wlan0/ping we can abuse DESTINATION parameter and leverage it to remote code execution.

Affected products

Vendor Elsight Product Elsight Halo Default
unaffected
- Version
  All versions
  Status
  affected
  Constraints
  <Update to version 10.6.1

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

unaffected

Version	Status	Constraints
All versions	affected	<Update to version 10.6.1

Remediation

Vendor solution

Update to version 10.6.1

Weaknesses (1)

CWE-20

Improper Input Validation

References (1)

https://www.gov.il/en/Departments/faq/cve_advisories
Third Party Advisory

Link	Providers	Tags
https://www.gov.il/en/Departments/faq/cve_advisories		Third Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner INCD

Published Nov 17, 2022

Updated Apr 25, 2025

Reserved Jul 26, 2022

Link CVE-2022-36784

CISA Vulnrichment

Updated Apr 25, 2025

Status Modified

Modified Jun 17, 2026

Link CVE-2022-36784

Severity n/a

Public date n/a

Links CVE-2022-36784