CVE-2022-24628 in Device Manager Express
Summary
by MITRE • 05/30/2023
An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is authenticated SQL injection in the id parameter of IPPhoneFirmwareEdit.php.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 05/03/2026
The vulnerability CVE-2022-24628 represents a critical authenticated SQL injection flaw within the AudioCodes Device Manager Express platform version 7.8.20002.47752 and earlier. This issue specifically affects the IPPhoneFirmwareEdit.php component where the id parameter is improperly validated and sanitized before being incorporated into database queries. The vulnerability stems from inadequate input sanitization mechanisms that fail to properly escape or parameterize user-supplied data, creating an exploitable entry point for malicious actors who have authenticated access to the system.
The technical exploitation of this vulnerability occurs when an authenticated attacker manipulates the id parameter in the IPPhoneFirmwareEdit.php endpoint to inject malicious SQL commands. This allows the attacker to execute arbitrary database operations including but not limited to data extraction, modification, or deletion. The vulnerability is classified as CWE-89 SQL Injection, which is a well-documented weakness in application security where untrusted data is directly incorporated into SQL query construction without proper sanitization. The attack vector requires prior authentication, meaning the attacker must first establish valid credentials to the system, but once authenticated, the impact can be severe as the attacker can leverage the authenticated session to perform database operations with the privileges of the authenticated user.
The operational impact of this vulnerability extends beyond simple data compromise as it can enable attackers to escalate privileges within the device management system. An authenticated SQL injection vulnerability in a device management platform like AudioCodes Device Manager Express can potentially allow attackers to manipulate firmware configurations, access sensitive device information, or even gain deeper system access that could compromise the entire network infrastructure. The vulnerability affects organizations that rely on AudioCodes solutions for managing IP phone devices, making it particularly concerning for enterprises with extensive VoIP infrastructure deployments. The presence of this vulnerability in a device management system also raises concerns about potential lateral movement within network environments where these devices are deployed, as attackers could use the compromised system as a foothold for further attacks.
Organizations should implement immediate mitigations including applying the latest security patches provided by AudioCodes, implementing proper input validation and parameterization of all database queries, and conducting comprehensive security assessments of their device management systems. Network segmentation and privilege least-privilege principles should be enforced to limit the potential impact of successful exploitation. Additionally, monitoring for unusual database access patterns and implementing web application firewalls can provide additional layers of defense. The vulnerability aligns with ATT&CK technique T1071.004 Application Layer Protocol: DNS, where attackers might use compromised systems to further their objectives, though the primary concern here is the database-level compromise. Regular security audits and vulnerability assessments should be conducted to identify similar injection vulnerabilities in other components of the system. The remediation process should include thorough code review of all database interaction points to ensure proper implementation of parameterized queries and input validation mechanisms that align with industry best practices for preventing SQL injection attacks.