Vulnerability record · CVE-2022-21234 · published 14 April 2022
CVE-2022-21234: Lansweeper EchoAssets.aspx SQL injection via authenticated HTTP request
Lansweeper · Lansweeper
Lansweeper 9.1.20.2 contains an SQL injection flaw in the EchoAssets.aspx functionality. A specially crafted HTTP request can inject SQL, and the attacker must be authenticated to send it. Because the vulnerable component is a network-reachable web endpoint, successful exploitation can expose or alter the underlying database.
Description
An SQL injection vulnerability exists in the EchoAssets.aspx functionality of Lansweeper lansweeper 9.1.20.2. A specially-crafted HTTP request can cause SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Automated analysis
high priorityCVSS 8.8 with high confidentiality, integrity, and availability impact, plus a very high EPSS score and public exploit detail, though exploitation requires authentication.
What it is
Lansweeper 9.1.20.2 contains an SQL injection flaw in the EchoAssets.aspx functionality. A specially crafted HTTP request can inject SQL, and the attacker must be authenticated to send it. Because the vulnerable component is a network-reachable web endpoint, successful exploitation can expose or alter the underlying database.
Impact
An authenticated attacker can read, modify, or delete data in the Lansweeper database and potentially execute database-level operations. The CVSS vector rates confidentiality, integrity, and availability impact as high.
Attack surface
The flaw is reached over the network through the EchoAssets.aspx endpoint. Authentication is required (PR:L), and no user interaction is needed (UI:N).
Exploitation
No CISA KEV listing and no ransomware group usage are documented. EPSS is very high (0.72601, 99.4th percentile), and the Talos reference is tagged Exploit, indicating public exploit detail is available.
What to do
- Apply the Lansweeper update referenced in the vendor changelog as soon as possible.
- Restrict network access to the Lansweeper web interface to trusted management networks.
- Review and minimize accounts with access to the Lansweeper application, removing unnecessary users.
- Monitor and audit authenticated requests to EchoAssets.aspx for anomalous SQL-like parameters.
- If immediate patching is not possible, deploy a WAF rule to block SQL injection patterns against EchoAssets.aspx.
Detection
- Inspect web server and application logs for requests to EchoAssets.aspx containing SQL keywords, quotes, or comment sequences.
- Alert on unusual database errors or query failures originating from the Lansweeper application.
- Baseline normal EchoAssets.aspx parameter values and flag deviations or unusually long inputs.
- Correlate authenticated Lansweeper sessions with outbound database activity or unexpected data access patterns.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://talosintelligence.com/vulnerability_reports/TALOS-2022-1443 | ExploitThird Party Advisory |
| https://www.lansweeper.com/changelog/ | Release NotesVendor Advisory |
| https://talosintelligence.com/vulnerability_reports/TALOS-2022-1443 | ExploitThird Party Advisory |
| https://www.lansweeper.com/changelog/ | Release NotesVendor Advisory |
Track CVE-2022-21234 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2022-21234), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
