CVE-2022-27438: 3cx Call Flow Designer

High severity, CVSS 8.1. EPSS: 2% chance of exploitation in the next 30 days.

Caphyon Ltd Advanced Installer 19.3 and earlier and many products that use the updater from Advanced Installer (Advanced Updater) are affected by a remote code execution vulnerability via the CustomDetection parameter in the update check function. To exploit this vulnerability, a user must start an affected installation to trigger the update check.

Affected products

• 3cx Call Flow Designer: version 18.2.13 only
• 3cx CRM Template Generator: version 2.1.23 only
• Boom Boomtv Streamer Portal: version 2.2.1 only
• Caphyon Advanced Installer: before 19.4 (fixed in 19.4)
• Codesector Direct Folders: version 4.0 only
• Codesector Teracopy: version 3.8.5 only
• Emeditor Emeditor: version 21.3.0 only
• Flamory Flamory: version 4.2.19.0 only
• Freesnippingtool Free Snipping Tool: version 5.6.0.0 only
• Fxsound Fxsound: version 1.1.12.0 only
• Gainedge Better Explorer: version 2020.3.15.1304 only
• Gamecaster Gamecaster: version 4.0.2109.2802 only
• Getmailbird Mailbird: version 2.9.50.0 only
• Guzogo Guzogo: version 1.0.5.0 only
• Honeygain Honeygain: version 0.10.7.0 only
• Jki Vi Package Manager: version 21.1.2754 only
• Jpsoft Take Command: version 28.2.18 only
• Krylack Archive Password Recovery: version 3.70.69 only
• Krylack Asterisks Password Decryptor: version 3.31.107 only
• Krylack Burning Suite: version 1.20.05 only
• Krylack Rar Password Recovery: version 3.70.69 only
• Krylack Volume Serial Number Editor: version 2.02.34 only
• Krylack Zip Password Recovery: version 3.70.69 only
• Moonsoftware Password Agent: version 20.10.1 only
• Nefarius Scptoolkit: version 1.6.238.16010 only
• and 45 more

Published 2022-06-06. Last modified 2026-07-09.