CVE-2022-27438: 3cx call_flow_designer Download of Code Without Integrity Check

Vulnerability summary

CVE-2022-27438 is a high (CVSS 8.1) Download of Code Without Integrity Check vulnerability in 3cx call_flow_designer. EPSS estimates a 1.98% chance of exploitation in the next 30 days, higher than 80.3% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 06-06-2022
   PublishedVulnerability first disclosed.
2. 09-07-2026
   Last modifiedVulnerability information updated.

Description

Caphyon Ltd Advanced Installer 19.3 and earlier and many products that use the updater from Advanced Installer (Advanced Updater) are affected by a remote code execution vulnerability via the CustomDetection parameter in the update check function. To exploit this vulnerability, a user must start an affected installation to trigger the update check.

• CWE-494Download of Code Without Integrity CheckThe product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.