{"id":"CVE-2022-27438","aliases":["EUVD-2022-31941","GHSA-5xhh-3gjf-pf84"],"status":"published","title":"Caphyon Ltd Advanced Installer 19.2 was discovered to contain a remote code execution (RCE)...","description":"Caphyon Ltd Advanced Installer 19.3 and earlier and many products that use the updater from Advanced Installer (Advanced Updater) are affected by a remote code execution vulnerability via the CustomDetection parameter in the update check function. To exploit this vulnerability, a user must start an affected installation to trigger the update check.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.0211,"percentile":0.81921,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-494"],"published":"2022-06-06T22:21:30Z","modified":"2026-10-28T02:31:00Z","exploits":[{"source":"pocgithub","id":"gar-re/cve-2022-27438","title":"gar-re/cve-2022-27438","date":"2022-06-01","url":"https://github.com/gar-re/cve-2022-27438"}],"products":[{"vendor":"3cx","product":"call_flow_designer"},{"vendor":"3cx","product":"crm_template_generator"},{"vendor":"boom","product":"boomtv_streamer_portal"},{"vendor":"caphyon","product":"advanced_installer"},{"vendor":"codesector","product":"direct_folders"},{"vendor":"codesector","product":"teracopy"},{"vendor":"emeditor","product":"emeditor"},{"vendor":"flamory","product":"flamory"},{"vendor":"freesnippingtool","product":"free_snipping_tool"},{"vendor":"fxsound","product":"fxsound"},{"vendor":"gainedge","product":"better_explorer"},{"vendor":"gamecaster","product":"gamecaster"},{"vendor":"getmailbird","product":"mailbird"},{"vendor":"guzogo","product":"guzogo"},{"vendor":"honeygain","product":"honeygain"},{"vendor":"jki","product":"vi_package_manager"},{"vendor":"jpsoft","product":"take_command"},{"vendor":"krylack","product":"archive_password_recovery"},{"vendor":"krylack","product":"asterisks_password_decryptor"},{"vendor":"krylack","product":"burning_suite"},{"vendor":"krylack","product":"rar_password_recovery"},{"vendor":"krylack","product":"volume_serial_number_editor"},{"vendor":"krylack","product":"zip_password_recovery"},{"vendor":"moonsoftware","product":"password_agent"},{"vendor":"nefarius","product":"scptoolkit"},{"vendor":"plagiarismcheckerx","product":"plagiarism_checker_x"},{"vendor":"prusa3d","product":"prusaslicer"},{"vendor":"realdefense","product":"mycleanid"},{"vendor":"realdefense","product":"mycleanpc"},{"vendor":"realdefense","product":"mypasslock"},{"vendor":"rovio","product":"angry_birds_space"},{"vendor":"rovio","product":"bad_piggies"},{"vendor":"rstinstruments","product":"c109_firmware"},{"vendor":"rstinstruments","product":"dt2011_firmware"},{"vendor":"rstinstruments","product":"dt2011b_firmware"},{"vendor":"rstinstruments","product":"dt2040_firmware"},{"vendor":"rstinstruments","product":"dt2050_firmware"},{"vendor":"rstinstruments","product":"dt2050b_firmware"},{"vendor":"rstinstruments","product":"dt2055b_firmware"},{"vendor":"rstinstruments","product":"dt2306_firmware"},{"vendor":"rstinstruments","product":"dt2350_firmware"},{"vendor":"rstinstruments","product":"dt2485_firmware"},{"vendor":"rstinstruments","product":"dt4205_firmware"},{"vendor":"rstinstruments","product":"dtl201b\\/2b_firmware"},{"vendor":"rstinstruments","product":"dtsaa_firmware"},{"vendor":"rstinstruments","product":"gaa2820_firmware"},{"vendor":"rstinstruments","product":"ic6560_firmware"},{"vendor":"rstinstruments","product":"ic6660_firmware"},{"vendor":"rstinstruments","product":"inclinalysis_digital_inclinometer"},{"vendor":"rstinstruments","product":"ipi_utility"},{"vendor":"rstinstruments","product":"ir420_firmware"},{"vendor":"rstinstruments","product":"lp100_firmware"},{"vendor":"rstinstruments","product":"ma7_firmware"},{"vendor":"rstinstruments","product":"mems_tilt_meter_firmware"},{"vendor":"rstinstruments","product":"mtcm_firmware"},{"vendor":"rstinstruments","product":"portable_tilt_meter_firmware"},{"vendor":"rstinstruments","product":"qb120_firmware"},{"vendor":"rstinstruments","product":"rstar_rtu_host"},{"vendor":"rstinstruments","product":"rtu_firmware"},{"vendor":"rstinstruments","product":"sg350_firmware"},{"vendor":"rstinstruments","product":"th2016_firmware"},{"vendor":"rstinstruments","product":"th2016b_firmware"},{"vendor":"rstinstruments","product":"vw0420_firmware"},{"vendor":"rstinstruments","product":"vw2106_firmware"},{"vendor":"synaptics","product":"displaylink_usb_graphics"},{"vendor":"urban-vpn","product":"urban_vpn"},{"vendor":"vigem","product":"vigembus_driver"},{"vendor":"vpnhood","product":"vpnhood"},{"vendor":"vrdesktop","product":"virtual_desktop_streamer"},{"vendor":"xsplit","product":"xsplit_express_video_editor"}],"references":[{"url":"https://gerr.re/posts/cve-2022-27438/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","web"]},{"url":"https://www.advancedinstaller.com/security-updates-auto-updater.html","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-27438","tags":["advisory"]},{"url":"http://advanced.com"},{"url":"http://caphyon.com"},{"url":"https://gerr.re/posts/cve-2022-27438"},{"url":"https://github.com/advisories/GHSA-5xhh-3gjf-pf84"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/27xxx/CVE-2022-27438.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-27438","description":"Caphyon Ltd Advanced Installer 19.3 and earlier and many products that use the updater from Advanced Installer (Advanced Updater) are affected by a remote code execution vulnerability via the CustomDetection parameter in the update check function. To exploit this vulnerability, a user must start an affected installation to trigger the update check.","status":"published","published":"2022-06-06T22:21:30Z","modified":"2026-07-09T00:18:18.572Z","updated_at":"2026-11-02T14:34:34.250357Z"}],"euvd":[{"id":"EUVD-2022-31941","description":"Caphyon Ltd Advanced Installer 19.3 and earlier and many products that use the updater from Advanced Installer (Advanced Updater) are affected by a remote code execution vulnerability via the CustomDetection parameter in the update check function. To exploit this vulnerability, a user must start an affected installation to trigger the update check.","status":"published","published":"2022-06-06T22:21:30Z","modified":"2026-07-09T00:18:18Z","updated_at":"2026-11-02T18:20:08.115071Z"}],"ghsa":[{"id":"GHSA-5xhh-3gjf-pf84","title":"Caphyon Ltd Advanced Installer 19.2 was discovered to contain a remote code execution (RCE)...","description":"Caphyon Ltd Advanced Installer 19.2 was discovered to contain a remote code execution (RCE) vulnerability via the Update Check function.","status":"published","published":"2022-06-07T00:00:31Z","modified":"2026-07-05T00:32:38Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-494"],"updated_at":"2026-11-02T15:09:14.897479Z"}],"nvd":[{"id":"CVE-2022-27438","description":"Caphyon Ltd Advanced Installer 19.3 and earlier and many products that use the updater from Advanced Installer (Advanced Updater) are affected by a remote code execution vulnerability via the CustomDetection parameter in the update check function. To exploit this vulnerability, a user must start an affected installation to trigger the update check.","status":"published","published":"2022-06-06T23:15:07.92Z","modified":"2026-07-09T01:17:24.037Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5.1,"vector":"AV:N/AC:H/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-494"],"updated_at":"2026-11-02T14:07:21.62951Z"}],"osv":[{"id":"CVE-2022-27438","description":"Caphyon Ltd Advanced Installer 19.3 and earlier and many products that use the updater from Advanced Installer (Advanced Updater) are affected by a remote code execution vulnerability via the CustomDetection parameter in the update check function. To exploit this vulnerability, a user must start an affected installation to trigger the update check.","status":"published","published":"2022-06-06T22:21:30Z","modified":"2026-10-28T02:31:00.932914958Z","updated_at":"2026-11-02T15:44:24.758293Z"}]}}