CVE-2022-24999

highpriority · attend · 45EPSS 0.156 · 97 %ileexploit · PoCCHDEEUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

1 exploit · PoC

Likely / severe?

15.6% (97th) EPSS

CVSS 7.5 · high

Is it mine?

48 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · abb_psirt · cert_bund

EPSS · scored 2026-10-26

qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b&a[__proto__]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has "deps: qs@6.9.7" in its release description, is not vulnerable).

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedRMC-100abb_psirt
The problem is corrected in the following product versions: RMC-100 Customer Package (2105452-048). RMC-100 LITE Customer Package (2106260-017). ABB recommends that customers apply the update at earliest convenience. Please find these updates here: RMC - Flow Computers (Flow Computers, Remote Controllers and RTUs) | Flow Computers | ABB
https://new.abb.com/products/measurement-products/upstream-oil-and-gas/flow-computers-remote-controllers/flow-computers/rmc
FixedRMC-100 LITEabb_psirt
The problem is corrected in the following product versions: RMC-100 Customer Package (2105452-048). RMC-100 LITE Customer Package (2106260-017). ABB recommends that customers apply the update at earliest convenience. Please find these updates here: RMC - Flow Computers (Flow Computers, Remote Controllers and RTUs) | Flow Computers | ABB
https://new.abb.com/products/measurement-products/upstream-oil-and-gas/flow-computers-remote-controllers/flow-computers/rmc
FixedRMC-100cisa_csaf_ot
The problem is corrected in the following product versions: RMC-100 Customer Package (2105452-048). RMC-100 LITE Customer Package (2106260-017). ABB recommends that customers apply the update at earliest convenience. Please find these updates here: RMC - Flow Computers (Flow Computers, Remote Controllers and RTUs) | Flow Computers | ABB
https://new.abb.com/products/measurement-products/upstream-oil-and-gas/flow-computers-remote-controllers/flow-computers/rmc
FixedRMC-100 LITEcisa_csaf_ot
The problem is corrected in the following product versions: RMC-100 Customer Package (2105452-048). RMC-100 LITE Customer Package (2106260-017). ABB recommends that customers apply the update at earliest convenience. Please find these updates here: RMC - Flow Computers (Flow Computers, Remote Controllers and RTUs) | Flow Computers | ABB
https://new.abb.com/products/measurement-products/upstream-oil-and-gas/flow-computers-remote-controllers/flow-computers/rmc

cvss

Technical severity, 0–10. One row per scoring source.

7.5

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 3.6

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · CISA US

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · ENISA EU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondaryexploitability 3.9 · impact 3.6

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · OSV

v3.17.1highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:Psecondary · CVSS-BT (t0sche)

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · ABB PSIRT

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: poc · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-1321USprimaryCWE-1321USCWE-1321USCWE-1321US

exploits (1)

Public proof-of-concept and weaponised exploit code.

9pings/CVE-2022-24999"qs" prototype poisoning vulnerability ( CVE-2022-24999 )PoC · poc_in_github

affected products (48)

Products and version ranges known to be affected.

ABB RMC-100all versionsfixedabb_psirtCH
ABB RMC-100210547-036| → 2105457-044abb_psirtCH
ABB RMC-100 LITEall versionsfixedabb_psirtCH
ABB RMC-100 LITE2106229-010| → 2106229-016abb_psirtCH
Dell Data Protection Advisor <19.12all versionscert_bundDE
IBM DB2all versionscert_bundDEcpe:/a:ibm:db2:-
Red Hat Enterprise Linuxall versionscert_bundDEcpe:/o:redhat:enterprise_linux:-
SUSE Linuxall versionscert_bundDEcpe:/o:suse:suse_linux:-
Splunk Splunk Enterprise <8.1.14all versionscert_bundDE
Splunk Splunk Enterprise <8.2.11all versionscert_bundDE
Splunk Splunk Enterprise <9.0.5all versionscert_bundDE
Atlassian Confluence< 10.0.2cert_bundDE
Atlassian Confluence< 10.1.1cert_bundDE
Atlassian Confluence< 8.5.25cert_bundDE
Atlassian Confluence< 9.2.7cert_bundDE
Dell Data Protection Advisor< 19.12cert_bundDE
Splunk Splunk Enterprise< 8.1.14cert_bundDE
Splunk Splunk Enterprise< 8.2.11cert_bundDE
Splunk Splunk Enterprise< 9.0.5cert_bundDE
RMC-100 (2105457-036 to 2105457-044) all versionscisa_csaf_otUS

showing 20 of 48

advisories (9)

Vendor and ecosystem advisories describing this.

9AKK108470A8565RMC-100 Vulnerability in the Web UI (REST Interface)2025-03-11csaf · abb_psirtCH
An update is available that resolves a vulnerability in the product versions listed as affected in this advisory. An attacker who successfully exploited this vulnerability could cause the web UI to stop.
WID-SEC-W-2023-0398Red Hat Advanced Cluster Management for Kubernetes: Schwachstelle ermöglicht Denial of ServiceDeutsch2023-02-15csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle im Red Hat Advanced Cluster Management for Kubernetes ausnutzen, um einen Denial of Service Angriff durchzuführen.
WID-SEC-W-2023-0809IBM QRadar SIEM: Mehrere SchwachstellenDeutsch2023-03-30csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM QRadar SIEM ausnutzen, um beliebigen Programmcode auszuführen, Informationen offenzulegen, Informationen falsch darzustellen, einen Denial of Service Zustand herbeizuführen, Sicherheitsvorkehrungen zu umgehen, einen Cross-Site-Scripting-Angriff durchzuführen oder unbekannte Auswirkungen zu verursachen.
WID-SEC-W-2023-0822HCL BigFix: Schwachstelle ermöglicht Denial of ServiceDeutsch2023-04-02csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in HCL BigFix ausnutzen, um einen Denial of Service Angriff durchzuführen.
WID-SEC-W-2023-1295Red Hat OpenShift: Mehrere SchwachstellenDeutsch2023-05-23csaf · cert_bundDE
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service zu verursachen.
WID-SEC-W-2023-1350Splunk Splunk Enterprise: Mehrere Schwachstellen in Komponenten von DrittanbieternDeutsch2023-06-01csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Splunk Splunk Enterprise in diversen Komponenten von Drittanbietern ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.
WID-SEC-W-2023-2229Splunk Splunk Enterprise: Mehrere SchwachstellenDeutsch2023-08-30csaf · cert_bundDE
Ein entfernter, authentifizierter Angreifer kann mehrere Schwachstellen in Splunk Splunk Enterprise ausnutzen, um beliebigen Code auszuführen, einen 'Denial of Service'-Zustand zu verursachen, seine Privilegien zu erweitern und weitere, nicht spezifizierte Auswirkungen zu verursachen.
GHSA-hrpp-h998-j3ppqs vulnerable to Prototype Pollution2022-11-27ghsa · osvUS
qs before 6.10.3 allows attackers to cause a Node process hang because an `__ proto__` key can be used. In many typical web framework use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as `a[__proto__]=b&a[__proto__]&a[length]=100000000`. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4.
ICSA-25-084-01ABB RMC-1002025-03-11icsa · cisa_csaf_otUS
An update is available that resolves a vulnerability in the product versions listed as affected in this advisory. An attacker who successfully exploited this vulnerability could cause the web UI to stop.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd abb_psirt cert_bund cisa_csaf_ot osv NVD CVE.org MITRE

published 2022-11-26modified 2026-06-17

related (707)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2026-34621US	—OT critical	7.23% (94th)	KEV	2026-04-11
Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerab…
CVE-2019-0230US	critical9.8	96.9% (100th)	Exploit	2020-09-14
Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.
CVE-2022-24760US	critical10.0	49.4% (99th)	Exploit	2022-03-12
Parse Server is an open source http web server backend. In versions prior to 4.10.7 there is a Remote Code Execution (RCE) vulnerability in Parse Server. This vulnerability affects…
CVE-2019-11358US	medium6.1	86.8% (100th)	Exploit	2019-04-20
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source ob…
CVE-2020-7774US	critical9.8	69.4% (99th)	—	2020-11-17
The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.

+702 more

references (25)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan