CVE-2022-44039 Path traversal in n/a

Critical 9.8 Published 5 Dec 2022 Updated 24 Apr 2025

An attacker can remotely overwrite system files like passwd to escalate privileges to root in Franklin Fueling System FFS Colibri.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-44039?

CVE-2022-44039 is a critical path traversal vulnerability in n/a, published on 5 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Franklin Fueling System FFS Colibri 1.9.22.8925 is affected by: File system overwrite. The impact is: File system rewrite (remote). ¶¶ An attacker can overwrite system files like [system.conf] and [passwd], this occurs because the insecure usage of "fopen" system function with the mode "wb" which allows overwriting file if exists. Overwriting files such as passwd, allows an attacker to escalate his privileges by planting backdoor user with root privilege or change root password.

Weakness: CWE-863

Which versions are affected by CVE-2022-44039?

It affects 1 product.

Products include Franklinfueling Colibri Firmware.

How do I fix CVE-2022-44039?

No fix has been published for CVE-2022-44039 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2022-44039 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-44039 exists.

Sources

Also known as GHSA-6439-9fxj-fc35.