Vulnerability record · CVE-2022-38130 · published 10 August 2022
CVE-2022-38130: Keysight Sensor Management Server unauthenticated database restore via UNC path
Keysight · Sensor Management Server
The smsRestoreDatabaseZip() method in Keysight Sensor Management Server accepts a path to a zipped HSQLDB database and restores it without validating the source. An unauthenticated remote attacker can point it at a UNC path on their own host, so the server restores an attacker-controlled database. Because the restored database drives SMS behavior, this is a full compromise of the application's data and logic.
Description
The com.keysight.tentacle.config.ResourceManager.smsRestoreDatabaseZip() method is used to restore the HSQLDB database used in SMS. It takes the path of the zipped database file as the single parameter. An unauthenticated, remote attacker can specify an UNC path for the database file (i.e., \\<attacker-host>\sms\<attacker-db.zip>), effectively controlling the content of the database to be restored.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.8 with no authentication or user interaction required and a very high EPSS score make this an urgent pre-auth compromise path.
What it is
The smsRestoreDatabaseZip() method in Keysight Sensor Management Server accepts a path to a zipped HSQLDB database and restores it without validating the source. An unauthenticated remote attacker can point it at a UNC path on their own host, so the server restores an attacker-controlled database. Because the restored database drives SMS behavior, this is a full compromise of the application's data and logic.
Impact
An attacker gains control over the SMS database content, which can lead to data manipulation, code or logic injection through stored content, and full loss of confidentiality, integrity and availability of the SMS instance.
Attack surface
Reachable over the network with no authentication and no user interaction, per the CVSS vector AV:N/AC:L/PR:N/UI:N. The attacker only needs to supply a UNC path to a zip file they host.
Exploitation
Not listed in CISA KEV and no public exploit tag is present in the references, but EPSS is 0.54072 (99th percentile), indicating a high modeled likelihood of exploitation. No ransomware group is documented using it.
What to do
- Apply the vendor fix for the SMS database restore function as soon as an update is available; treat this as the first action.
- Block outbound SMB/UNC access from the SMS server so it cannot fetch files from attacker-controlled hosts.
- Restrict network access to the SMS restore interface to trusted management networks only.
- Validate and allowlist database restore source paths, rejecting UNC and remote paths.
- Monitor and alert on unexpected HSQLDB restore operations and on outbound SMB connections from the SMS host.
Detection
- Alert on outbound SMB (TCP 445/139) connections originating from the SMS server to non-approved hosts.
- Log and review all invocations of the database restore function, including the supplied path parameter.
- Monitor for unexpected changes to the SMS HSQLDB files or schema after restore operations.
- Correlate SMS server process activity with remote host connections to identify UNC-based file retrieval.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://www.tenable.com/security/research/tra-2022-28 | Third Party Advisory |
| https://www.tenable.com/security/research/tra-2022-28 | Third Party Advisory |
Track CVE-2022-38130 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2022-38130), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
