LiveActive security incident?Get immediate response
CVE Record

CVE-2022-28944: Certain EMCO Software products are affected by: CWE-494: Download of Code Without Integrity Check.

Certain EMCO Software products are affected by: CWE-494: Download of Code Without Integrity Check. This affects MSI Package Builder for Windows 9.1.4 and Remote Installer for Windows 6.0.13 and Ping Monitor for Windows 8.0.18 and Remote Shutdown for Windows 7.2.2 and WakeOnLan 2.0.8 and Network Inventory for Windows 5.8.22 and Network Software Scanner for Windows 2.0.8 and UnLock IT for Windows 6.1.1. The impact is: execute arbitrary code (remote). The component is: Updater. The attack vector is: To exploit this vulnerability, a user must trigger an update of an affected installation of EMCO Software. ¶¶ Multiple products from EMCO Software are affected by a remote code execution vulnerability during the update process.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2022-28944 affects several EMCO Software Windows products whose updater may download code without verifying integrity. If a user triggers an update on an affected installation, the update path could lead to remote arbitrary code execution. The source bundle does not provide a CVSS score, patch status, or evidence of exploitation.

Executive priority

Treat this as a targeted software supply-chain style risk for affected EMCO deployments. Prioritize inventory and vendor remediation confirmation, especially on administrator workstations or systems managing other endpoints.

Technical view

The reported weakness is CWE-494 in the updater component: download of code without integrity check. Affected versions listed include MSI Package Builder 9.1.4, Remote Installer 6.0.13, Ping Monitor 8.0.18, Remote Shutdown 7.2.2, WakeOnLan 2.0.8, Network Inventory 5.8.22, Network Software Scanner 2.0.8, and UnLock IT 6.1.1.

Likely exposure

Exposure is likely limited to organizations running the named EMCO Software products and versions on Windows. Risk is highest where users or administrators can trigger in-application updates on managed systems.

Exploitation context

The source states exploitation requires a user to trigger an update of an affected EMCO installation. The CVE is not listed as KEV in the provided bundle, and no cited source confirms active exploitation.

Researcher notes

Evidence is limited to the CVE description and linked public advisory reference. The bundle provides no CVSS vector, no named fixed version, and no exploitation confirmation. Avoid assuming broader EMCO versions are affected beyond the listed versions.

Mitigation direction

  • Inventory systems for the named EMCO products and affected versions.
  • Check EMCO vendor guidance for fixed versions or supported remediation.
  • Avoid triggering affected product updates until vendor guidance is confirmed.
  • Remove unused affected EMCO products from managed Windows systems.
  • Monitor affected hosts for unexpected activity following update attempts.

Validation and detection

  • Confirm whether any listed EMCO product versions are installed.
  • Review software inventory and endpoint management records for EMCO installations.
  • Check whether users or administrators can initiate product updates.
  • Verify vendor guidance before marking remediation complete.
  • Review endpoint telemetry around recent EMCO update activity.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Execution behavior lookup

The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2022-28944 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
1ADP providers
2Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.