LiveActive security incident?Get immediate response
CVE Record

CVE-2022-39032: Smart eVision - Improper Privilege Management

Smart eVision has an improper privilege management vulnerability. A remote attacker with general user privilege can exploit this vulnerability to escalate to administrator privilege, and then perform arbitrary system command or disrupt service.

HighCVSS 8.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

Smart eVision 2022.02.21 has a privilege-management flaw that can let a regular authenticated user become an administrator. With administrator access, the attacker may run system commands or disrupt the service. The source bundle does not show confirmed active exploitation.

Executive priority

Prioritize remediation if Smart eVision 2022.02.21 is deployed. The business risk is high because a standard user account could become administrator and affect systems or service availability.

Technical view

CVE-2022-39032 is CWE-269 in Smart eVision. The CVSS 3.1 score is 8.8 with network access, low complexity, low privileges required, and no user interaction. Successful exploitation can escalate privileges and affect confidentiality, integrity, and availability.

Likely exposure

Exposure is limited to organizations running Smart eVision version 2022.02.21. Risk is higher where ordinary user accounts can access the application remotely, especially if the service is reachable from untrusted networks.

Exploitation context

The provided sources describe remote authenticated privilege escalation, but do not provide evidence of public exploitation or CISA KEV listing. Treat exploit status as unconfirmed based on this bundle.

Researcher notes

Key constraints are PR:L and UI:N, so validation should focus on authenticated user boundaries and role enforcement. The bundle does not name a patch, workaround, exploit, or affected versions beyond 2022.02.21.

Mitigation direction

  • Identify all Smart eVision deployments and confirm whether version 2022.02.21 is present.
  • Check Smart eVision or TWCERT guidance for vendor-approved updates or mitigations.
  • Restrict Smart eVision access to trusted networks and users where operationally possible.
  • Review and minimize general user accounts until remediation status is confirmed.
  • Monitor for unexpected administrator role changes or command execution indicators.

Validation and detection

  • Confirm installed Smart eVision versions against the affected 2022.02.21 version.
  • Review user-role configuration for unauthorized administrator assignments.
  • Check logs for recent privilege changes, administrative actions, or service disruptions.
  • Verify whether vendor or TWCERT remediation guidance has been applied.
  • Document exposed instances and compensating controls for vulnerability management tracking.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-269: Authorization and privilege behavior lookup

Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2022-39032 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
8.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
8.8CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H2.85.9Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

8.8High
CVSS 3.1 vector shape for CVE-2022-39032Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
Smart eVision Information Technology Inc.Smart eVision2022.02.21Listed
Weakness

CWE details

CWE-269

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-269 · source CWE mapping

Improper Privilege Management

Improper Privilege Management represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs