CVE-2022-32965— ITPison OMICARD EDM - Use of Hard-coded Credentials
Quick assessment
Affected
ITPison OMICARD EDM
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
ITPison OMICARD EDM是中国ITPison公司的一个高速电子报 EDM 行销发送系統。 ITPison OMICARD EDM存在安全漏洞。远程攻击者利用该漏洞可以使用机器密钥向服务器发送序列化载荷，以执行任意代码、操纵系统数据并中断服务。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2022-32965
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
ITPison OMICARD EDM - Use of Hard-coded Credentials
Source: CVE Program / CVE List V5
Vulnerability Description
OMICARD EDM has a hard-coded machine key. An unauthenticated remote attacker can use the machine key to send serialized payload to the server to execute arbitrary code, manipulate system data and disrupt service.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
使用硬编码的凭证
Source: CVE Program / CVE List V5
Vulnerability Title
ITPison OMICARD EDM 信任管理问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
ITPison OMICARD EDM是中国ITPison公司的一个高速电子报 EDM 行销发送系統。 ITPison OMICARD EDM存在安全漏洞。远程攻击者利用该漏洞可以使用机器密钥向服务器发送序列化载荷，以执行任意代码、操纵系统数据并中断服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| ITPison | OMICARD EDM | 5.8 ~ 6.0 | - |
|
II. Public POCs for CVE-2022-32965
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-32965
请登录查看更多情报信息。
Other References for CVE-2022-32965 (2)
-
https://www.twcert.org.tw/tw/cp-132-6373-34d51-1.html x_refsource_MISC
Same Patch Batch · ITPison · 2022-08-04 · 4 CVEs total
| CVE-2022-32964 | 9.8 CRITICAL | ITPison OMICARD EDM - SQL Injection |
| CVE-2022-32963 | 7.5 HIGH | ITPison OMICARD EDM - Path Traversal-1 |
| CVE-2022-35216 | 7.5 HIGH | ITPison OMICARD EDM - Use of Hard-coded Credentials |
IV. Related Vulnerabilities
Same product: OMICARD EDM
-
CVE-2026-10597
ITPison｜OMICARD EDM - Insecure Direct Object Reference -
CVE-2024-4894
ITPison OMICARD EDM - Server-Side Request Forgery -
CVE-2023-28700
ITPison OMICARD EDM - Arbitrary File Upload -
CVE-2022-35216
ITPison OMICARD EDM - Use of Hard-coded Credentials -
CVE-2022-32964
ITPison OMICARD EDM - SQL Injection
Same vendor: ITPison
-
CVE-2026-10597
ITPison｜OMICARD EDM - Insecure Direct Object Reference -
CVE-2024-4894
ITPison OMICARD EDM - Server-Side Request Forgery -
CVE-2023-48373
ITPison OMICARD EDM 's SMS - Path Traversal -
CVE-2023-48372
ITPison OMICARD EDM 's SMS - SQL Injection -
CVE-2023-48371
ITPison OMICARD EDM 's SMS - Arbitrary File Upload
Same weakness: CWE-798
-
CVE-2026-78062
vas3k TaxHacker JWT Secret config.ts envSchema.parse hard-co -
CVE-2026-76131
Yamaha VOCALOID6 硬编码凭据漏洞 -
CVE-2026-76392
Use of Hard-coded Credentials in Container Connections in Sp -
CVE-2026-71960
Cudy WR3000 2.0 Hard-coded JWT Secret Authentication Bypass -
CVE-2026-74893
openssl_encrypt before 1.4.0 JWT Token Forgery via Hardcoded
V. Comments for CVE-2022-32965
No comments yet