CVE-2022-28381

What it actually does

ALLMediaServer 1.6 contains a stack-based buffer overflow in Mediaserver.exe reachable over the network on TCP port 888. A remote, unauthenticated attacker can send an overly long string to the listening service and overwrite stack memory, potentially controlling execution flow and running arbitrary code in the context of the media server process. Because the CVSS vector is network-accessible, low complexity, no authentication required, and no user interaction required, successful exploitation can provide full confidentiality, integrity, and availability impact on the affected host.

Why it matters to the business

A vulnerable ALLMediaServer instance exposed to untrusted networks can be taken over remotely without credentials, allowing attackers to disrupt media services, install malware, steal accessible data, or use the host as a foothold for further internal movement. The high CVSS score, high EPSS score, and weaponized exploit maturity indicate meaningful real-world exploitation risk even though this issue is not currently listed in CISA KEV. The product is older and no fixed version is provided, so continued use may represent an ongoing operational and security liability.

How an attack unfolds

An attacker first identifies hosts running ALLMediaServer with Mediaserver.exe listening on TCP port 888. They then connect to that port and send a crafted overly long string that triggers the stack-based buffer overflow. If the payload is only a crash string, the service may terminate, causing denial of service. If the payload is weaponized with return-oriented programming or shellcode appropriate for the target process and platform, the attacker can redirect execution and run commands with the privileges of Mediaserver.exe. After code execution, the attacker may stage additional tooling, create persistence, disable defenses, access local files, scan the internal network, or pivot to other systems.

How to fix it

Remove or upgrade ALLMediaServer 1.6. No fixed version was provided for this advisory data, so the safest remediation is to discontinue use of the vulnerable version, replace it with a supported alternative, or obtain a vendor-confirmed patched release before redeployment. If immediate removal is not possible, restrict TCP port 888 to only trusted management or media clients using host firewalls, network ACLs, VPN access, and segmentation; block internet exposure entirely. Run the service with the least privileges possible, monitor it closely, and consider application control to prevent Mediaserver.exe from launching child processes or writing executables to user-writable locations.

How to confirm the fix worked

Confirm whether ALLMediaServer 1.6 is installed and whether Mediaserver.exe is running. Verify that TCP port 888 is not reachable from the internet or other untrusted network zones. Use authenticated inventory, software management tools, EDR, or host inspection to validate removal or replacement of the vulnerable product. From a controlled scanner, confirm that port 888 is closed, filtered, or accessible only from approved source ranges. If a vendor-confirmed fixed build is deployed, validate the installed version against vendor documentation. Avoid using exploit payloads in production; if testing is required, use a lab environment or a non-destructive proof-of-concept that only validates safe handling of long input.

Typical attack path

1. Scan the internet or internal network for systems with TCP port 888 open and responsive as ALLMediaServer.
2. Fingerprint the service version or behavior to identify likely ALLMediaServer 1.6 exposure.
3. Open a TCP connection to port 888 and send an overly long crafted string designed to overflow the stack in Mediaserver.exe.
4. Redirect process execution to attacker-controlled code or cause the service to crash if exploitation is not fully reliable.
5. Execute commands under the Mediaserver.exe process context.
6. Deploy follow-on payloads, establish persistence, collect data, or use the compromised host for lateral movement.

How to detect it

Review network telemetry, firewall logs, NetFlow, packet captures, and IDS events for unexpected inbound connections to TCP port 888, especially from external or untrusted sources. On hosts, inspect Windows Event Logs, application logs, crash dumps, EDR telemetry, and process creation events for Mediaserver.exe crashes or abnormal behavior after receiving network traffic. Look for Mediaserver.exe spawning child processes such as cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe, rundll32.exe, certutil.exe, bitsadmin.exe, curl.exe, wget.exe, or unknown executables. Search for Windows Error Reporting events related to Mediaserver.exe access violations, stack buffer overflows, or application crashes. Investigate any new files, scheduled tasks, services, autoruns, or firewall rule changes created shortly after connections to TCP/888. Because exploitation may use custom shellcode and leave few fixed strings, behavioral evidence around the vulnerable process is more reliable than payload signatures.

• Mediaserver.exe
• TCP/888
• port 888
• Mediaserver.exe spawned cmd.exe
• Mediaserver.exe spawned powershell.exe
• Mediaserver.exe spawned wscript.exe
• Mediaserver.exe spawned cscript.exe
• Mediaserver.exe spawned mshta.exe
• Mediaserver.exe spawned rundll32.exe
• Mediaserver.exe spawned certutil.exe
• Mediaserver.exe spawned bitsadmin.exe
• Mediaserver.exe spawned curl.exe
• Mediaserver.exe spawned wget.exe
• Faulting application name: Mediaserver.exe
• Application Error
• Exception code: 0xc0000005
• Windows Error Reporting
• APPCRASH
• ALLMediaServer

What your security team should do

• Immediately inventory for ALLMediaServer installations and any hosts listening on TCP port 888.
• Prioritize internet-exposed or broadly reachable instances for removal, isolation, or replacement.
• Block inbound TCP/888 from untrusted networks at perimeter firewalls, internal segmentation controls, and host firewalls.
• Treat ALLMediaServer 1.6 as unsafe unless a vendor-confirmed patched build is available and verified.
• Hunt for prior exploitation by reviewing network connections to TCP/888, Mediaserver.exe crashes, unexpected child processes, and newly written executables around the service account context.
• Add EDR or application-control rules to alert when Mediaserver.exe spawns command shells, scripting interpreters, download tools, or unknown binaries.
• If suspicious activity is found, isolate the host, preserve evidence, rotate credentials that may have been exposed, and perform full incident response scoping.