Back Sploitus

CVE-2022-22954

Sploitus • September 14, 2026

Share: View original

ثغرة تنفيذ التعليمات البرمجية عن بُعد (RCE) في VMware Workspace ONE Access وIdentity Manager عبر SSTI.

CVE-2022-22954.py [-h] -m SET_MODE [-i IP] [-c CMD]

-h, --help show this help message and exit

* shodan: يسترجع قائمة عناوين IP بناءً على استعلام "http.favicon.hash:-1250474341"

* file: ضع قائمة عناوين IP الخاصة بك في ips.txt

* manual: مرر وسيطتي IP وCMD إلى الوضع manual عبر -m

هذا مجرد إثبات مفهوم (PoC). استخدمه على مسؤوليتك الخاصة وليس في بيئات الإنتاج أو البيئات الحقيقية. لا تسألني لماذا الكود هكذا أو إذا كان جيدًا أم سيئًا، لا يهمني. أنا لست مبرمجًا رائعًا وكودي قبيح.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Remote Code Execution Vulnerability in VMware Workspace ONE Access A critical remote code execution (RCE) vulnerability, CVE-2022-22954, affects VMware Workspace ONE Access and Identity Manager through server-side template injection (SSTI). The vulnerability was first published on April 11, 2022, and was added to the CISA Known Exploited Vulnerabilities (KEV) catalog on April 14, 2022. Recent proof-of-concept (PoC) code has been released, allowing attackers to exploit this vulnerability. The PoC code enables attackers to execute arbitrary commands on affected systems by leveraging specific queries on services like Shodan and Zoomeye. Security professionals are advised to avoid using this PoC in production environments. The vulnerability has been confirmed to impact numerous organizations using the affected VMware products. As of now, the exploit is publicly available, increasing the urgency for organizations to assess their exposure and apply necessary mitigations. 2 sources 70

Extracted Entities

CVE-2022-22954

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (1)

Tools (1)