← Vulnerability feed

Vulnerability record · CVE-2022-23858 · published 24 January 2022

CVE-2022-23858: Starwindsoftware command center vulnerability

Starwindsoftware · Command Center

A flaw was found in the REST API. An improperly handled REST API call could allow any logged user to elevate privileges up to the system account. This affects StarWind Command Center build 6003 v2.

8.8 CVSS 3.1 High EPSS 1.1% · top 35.1%
8.8CVSS 3.1 base score, v2 9.0
1.1%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

A flaw was found in the REST API. An improperly handled REST API call could allow any logged user to elevate privileges up to the system account. This affects StarWind Command Center build 6003 v2.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.starwindsoftware.com/security/sw-20220121-0001/ Vendor Advisory
https://www.starwindsoftware.com/security/sw-20220121-0001/ Vendor Advisory

Track CVE-2022-23858 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.8CVE-2021-4034polkit pkexec argument handling flaw allows local root escalationpkexec, the setuid polkit utility for running commands as privileged users, mishandles the calling parameter count and ends up treating environment v…KEVEPSS 94%analysed5.5CVE-2020-25704Linux kernel memory leak vulnerabilityA flaw memory leak in the Linux kernel performance monitoring subsystem was found in the way if using PERF_EVENT_IOC_SET_FILTER. A local user could u…EPSS 0.35%5.3CVE-2019-20807Vim os command injection vulnerabilityIn Vim before 8.1.0881, users can circumvent the rvim restricted mode and execute arbitrary OS commands via scripting interfaces (e.g., Python, Ruby,…EPSS 0.49%

Source: NIST National Vulnerability Database (record CVE-2022-23858), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.