CVE-2022-25369

Dynamicweb, a CMS and e-commerce platform, contains an authentication-bypass flaw (CWE-287/CWE-288) in the logic that determines whether the product's setup phases can be re-run, allowing an unauthenticated network attacker to create a new administrator user. After creating that account, the attacker logs in with it and can upload an executable file, escalating the compromise to arbitrary command execution on the server. Any Dynamicweb deployment running a version older than the patched release for its branch is affected, with no authentication or user interaction required. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known, but the EPSS score of 40.7% (99th percentile) indicates a substantial likelihood of exploitation within 30 days. Defenders should treat internet-facing Dynamicweb instances as high-priority patch targets.

What to do: Upgrade affected deployments to the fixed release for their branch: 9.5.9, 9.6.16, 9.7.8, 9.8.11, 9.9.8, 9.10.18, 9.12.8, or 9.13.0 (or later). As an interim mitigation, restrict network access to the Dynamicweb setup/admin endpoints from untrusted sources, and audit the administrator user list for recently created or unrecognized accounts plus any unexpectedly uploaded executable files.