LiveActive security incident?Get immediate response
CVE Record

CVE-2022-41777: Improper check or handling of exceptional conditions vulnerability in Nako3edit, editor component of nadesi...

Improper check or handling of exceptional conditions vulnerability in Nako3edit, editor component of nadesiko3 (PC Version) v3.3.74 and earlier allows a remote attacker to inject an invalid value to decodeURIComponent of nako3edit, which may lead the server to crash.

HighCVSS 7.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

Nako3edit in nadesiko3 PC Version can crash when it receives malformed input that reaches decodeURIComponent. The main business impact is availability: an unauthenticated remote attacker may be able to interrupt a vulnerable server, not steal data or alter records according to the supplied CVSS details.

Executive priority

Treat this as a high-priority availability risk where Nako3edit is reachable by untrusted users. Prioritize internet-facing or business-critical deployments first; internal-only lab systems are lower urgency.

Technical view

CVE-2022-41777 is CWE-703 in Nako3edit, the editor component of nadesiko3 PC Version v3.3.74 and earlier. The issue is improper exceptional-condition handling around invalid decodeURIComponent input. The supplied CVSS 3.1 vector is network, low complexity, no privileges, no user interaction, with high availability impact only.

Likely exposure

Exposure is limited to organizations running Nako3edit as part of nadesiko3 PC Version v3.3.74 or earlier, especially if the editor server is reachable from untrusted networks.

Exploitation context

The source bundle does not show CISA KEV listing or cited evidence of active exploitation. The CVSS vector indicates remote unauthenticated reachability and low attack complexity, but only availability impact is described.

Researcher notes

Do not assume data compromise from the provided evidence. The record describes server crash potential through invalid decodeURIComponent input, with CVSS confidentiality and integrity impact set to none. Fixed-version details are not present in the supplied bundle.

Mitigation direction

  • Inventory nadesiko3 PC Version deployments and identify Nako3edit use.
  • Check JVN and upstream GitHub guidance for fixed-version or vendor remediation details.
  • Restrict Nako3edit access to trusted networks until remediation is confirmed.
  • Monitor vulnerable hosts for unexpected service crashes or restart loops.

Validation and detection

  • Confirm whether installed nadesiko3 PC Version is v3.3.74 or earlier.
  • Verify whether Nako3edit is exposed to the internet or untrusted internal networks.
  • Review service logs for crashes linked to malformed request handling.
  • Track upstream issue 1325 and issue 1347 for remediation status.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-703: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2022-41777 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.5CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

7.5High
CVSS 3.1 vector shape for CVE-2022-41777Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
kujirahandNako3edit, editor component of nadesiko3 (PC Version)v3.3.74 and earlierListed
Weakness

CWE details

CWE-703

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.