CVE-2022-40022: Microchip SyncServer S650 command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with network reachability, no authentication and no user interaction, plus a very high EPSS score, makes this a top remediation target despite the thin record.

What it is

Microchip (Microsemi) SyncServer S650 firmware contains a command injection flaw (CWE-77). The CVSS 3.1 score is 9.8 critical with a network vector and no privileges or user interaction required, so an unauthenticated remote attacker can reach it. The record gives no affected version range and only a one-line description, so the exact injection point is not specified here.

Impact

An attacker can execute arbitrary commands on the device, giving full compromise of confidentiality, integrity and availability per the CVSS vector. On a network time server this can mean loss of accurate time and a foothold on the network.

Attack surface

Reachable over the network with no authentication and no user interaction (AV:N/AC:L/PR:N/UI:N). The description does not name the specific interface or parameter, so the exact entry point is unknown from this record.

Exploitation

Not listed in CISA KEV and no ransomware association is recorded, but EPSS is 0.92472 (99.82 percentile), indicating very high predicted likelihood. A Packet Storm reference is titled unauthenticated remote command execution, which suggests public exploit material exists.

What to do

• Apply the vendor fix for SyncServer S650 once Microchip publishes it; the record does not list a patch, so confirm with the vendor.
• If no patch is available, isolate SyncServer S650 devices from untrusted networks and restrict management access to a dedicated segment.
• Block or tightly filter network access to the device's management and service ports at the firewall.
• Monitor vendor advisories and the Securifera advisory for updated remediation guidance.
• Treat the device as untrusted and rotate any credentials or keys it holds.

Detection

• Monitor device and network logs for unexpected outbound connections or command execution activity from SyncServer S650 hosts.
• Alert on anomalous process or shell activity on the appliance where host-level telemetry is available.
• Watch for scanning or exploit attempts against the device's exposed services from the Securifera and Packet Storm references.
• Baseline normal management traffic to the device and alert on deviations, since the exact vulnerable endpoint is not documented here.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.