CVE-2022-24562

What it actually does

CVE-2022-24562 is an authentication bypass in the Airserv component of IOBit IOTransfer 4.3.1.1561. A remote, unauthenticated attacker can send crafted HTTP GET and POST requests to the service and obtain arbitrary read and write access across the endpoint file system with administrative privileges. Because write access occurs at high privilege, exploitation can lead to file disclosure, file modification, persistence placement, and remote code execution by writing executable content, scripts, or configuration changes that are later executed by the system or user context.

Why it matters to the business

Successful exploitation can allow an attacker to steal sensitive files, alter or destroy endpoint data, deploy malware, and gain control of affected machines without needing credentials or user interaction. Systems running exposed IOTransfer/Airserv services should be treated as high-risk because the vulnerability is network-exploitable, has a critical CVSS score, and public exploit information is available. Although it is not listed in CISA KEV and no ransomware use is indicated, the EPSS score is elevated, meaning exploitation is plausible in the wild, especially where the service is reachable from untrusted networks.

How an attack unfolds

An attacker first identifies a host running the vulnerable IOBit IOTransfer Airserv service, typically by scanning for the service port or HTTP responses associated with Airserv. Because authentication is missing or bypassable, the attacker does not need credentials. They then send crafted GET requests to read arbitrary files from the endpoint, which can expose documents, configuration files, credentials, browser data, SSH keys, tokens, or other sensitive content. Next, the attacker can use POST requests to write files anywhere the service account can access, which in this case may include administrative locations. By writing a script, executable, startup item, scheduled-task payload, or replacing an existing trusted file, the attacker can turn arbitrary file write into code execution. After execution, the attacker may establish persistence, disable defenses, exfiltrate data, or use the compromised endpoint as a foothold for lateral movement.

How to fix it

Upgrade IOBit IOTransfer to a vendor-supported fixed release if one is available from the vendor. No exact fixed version was provided in the supplied vulnerability data, so organizations should verify current vendor advisories and avoid relying on version 4.3.1.1561. If the product is no longer required, uninstall IOTransfer completely. If immediate removal or upgrade is not possible, disable the Airserv component/service, block inbound access to the Airserv listening port at host and network firewalls, restrict access to trusted management networks only, and ensure the service is not exposed to the internet. Because exploitation grants arbitrary file access with administrative privileges, any exposed vulnerable endpoint should be assessed for compromise before being returned to service.

How to confirm the fix worked

Confirm whether IOBit IOTransfer is installed and identify the installed version through software inventory, endpoint management tooling, or local application metadata. Verify that version 4.3.1.1561 is no longer present or that the vendor-confirmed fixed version is installed. Confirm the Airserv service is stopped or removed if IOTransfer is not needed. From an untrusted network segment, verify that the Airserv listening port is not reachable. Review firewall rules to ensure inbound access is blocked except where explicitly required. Where possible, perform an authenticated endpoint check for IOTransfer binaries and service entries, and a network check for Airserv HTTP banners or responses. For previously exposed systems, validate that no unexpected files, startup entries, scheduled tasks, or unknown executables were created during the exposure window.

Typical attack path

1. Scan networks for hosts exposing the IOBit IOTransfer Airserv HTTP service.
2. Confirm the service appears to be IOTransfer/Airserv and is running a vulnerable version such as 4.3.1.1561.
3. Send unauthenticated crafted GET requests to retrieve arbitrary files from the endpoint.
4. Review stolen files for credentials, tokens, user data, configuration files, or other sensitive information.
5. Send unauthenticated crafted POST requests to write files to privileged locations on the endpoint.
6. Place an executable, script, web-accessible payload, startup entry, or other persistence mechanism.
7. Trigger or wait for execution of the written payload to obtain remote code execution.
8. Use the compromised endpoint for data theft, persistence, malware deployment, or lateral movement.

How to detect it

To determine whether exploitation already occurred, review network, proxy, host firewall, and endpoint telemetry for unauthenticated HTTP GET and POST requests to the Airserv service from unexpected IP addresses. Focus on requests containing absolute or relative file paths, path traversal patterns, sensitive Windows paths, or attempts to write executable/script content. On endpoints, review IOTransfer/Airserv application logs if available, Windows Event Logs, EDR file modification telemetry, service creation events, scheduled task creation, startup-folder changes, PowerShell/script execution, and newly created files in privileged directories. Look for suspicious reads of credential stores, browser profile data, SSH keys, documents, and configuration files, followed by writes of binaries or scripts. Because the vulnerability can result in administrative file writes, also check for persistence artifacts such as new services, new scheduled tasks, Run/RunOnce registry entries, modified startup folders, and unknown executables created near the time of suspicious Airserv traffic.

• IOTransfer
• Airserv
• IOTransfer 4.3.1.1561
• GET /
• POST /
• ..%2f
• ..%5c
• ../
• ..\\
• C:\\Windows\\System32
• C:\\Windows\\Temp
• C:\\ProgramData
• C:\\Users\\Public
• C:\\Users\\Public\\Documents
• C:\\Users\\Default
• C:\\Users\\Administrator
• C:\\Users\\*\\AppData\\Roaming
• C:\\Users\\*\\AppData\\Local
• C:\\Users\\*\\Desktop
• C:\\Users\\*\\Documents
• C:\\Users\\*\\Downloads
• C:\\Users\\*\\.ssh
• id_rsa
• authorized_keys
• ntuser.dat
• SAM
• SYSTEM
• SECURITY
• SOFTWARE
• C:\\Windows\\System32\\config\\SAM
• C:\\Windows\\System32\\config\\SYSTEM
• C:\\Windows\\System32\\config\\SECURITY
• cmd.exe
• powershell.exe
• wscript.exe
• cscript.exe
• schtasks.exe
• regsvr32.exe
• rundll32.exe
• mshta.exe
• sc.exe
• HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run
• HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run
• C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup
• C:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup

What your security team should do

• Prioritize remediation for internet-facing or broadly reachable endpoints running IOBit IOTransfer, especially version 4.3.1.1561.
• Uninstall IOTransfer where there is no active business requirement; otherwise upgrade to a vendor-supported fixed release.
• Disable or firewall the Airserv component until the affected software is removed or confirmed fixed.
• Search endpoint inventory for IOTransfer and Airserv across workstations and servers.
• Treat exposed vulnerable systems as potentially compromised and perform forensic review for arbitrary file reads, suspicious file writes, and post-exploitation activity.
• Hunt for unusual HTTP GET and POST traffic to Airserv from unknown sources, especially repeated file-path probing or requests referencing sensitive system paths.
• Rotate credentials or tokens that may have been stored on systems confirmed or suspected to have been exposed.
• Add detection coverage for unexpected new executables, scripts, scheduled tasks, services, and startup-folder items created on endpoints running IOTransfer.