CVE-2022-24562
CriticalCVSS 9.8Exploitation Probability (EPSS)
Very high risk99th percentile - higher than 99% of all known CVEs
Summary
In IOBit IOTransfer 4.3.1.1561, an unauthenticated attacker can send GET and POST requests to Airserv, gaining arbitrary read/write access to the entire file system (with admin privileges) on the victim's endpoint, leading to data theft and remote code execution.
Risk Assessment
The risk includes full system compromise, sensitive data theft, and remote code execution by an unauthenticated attacker.
Recommendation
Immediately update IOBit IOTransfer to the latest version and restrict access to the Airserv service to trusted networks only.
Original NVD description (English source)
In IOBit IOTransfer 4.3.1.1561, an unauthenticated attacker can send GET and POST requests to Airserv and gain arbitrary read/write access to the entire file-system (with admin privileges) on the victim's endpoint, which can result in data theft and remote code execution.