CVE-2022-24581: Aceware Aceweb Online Portal

High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days.

ACEweb Online Portal 3.5.065 allows unauthenticated SMB hash capture via UNC. By specifying the UNC file path of an external SMB share when uploading a file, an attacker can induce the victim server to disclose the username and password hash of the user executing the ACEweb Online software.

Affected products

• Aceware Aceweb Online Portal: before 3.5.065 (fixed in 3.5.065)

Published 2022-06-02. Last modified 2026-07-09.