# CVE-2022-38840: Gucralp - XXE

> Live exploitation tracking for CVE-2022-38840 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2022-38840

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 7.5
- **Public exploit available:** Yes
- **Affected products:** Gucralp MAN-EAM-0003
- **Weaknesses:** CWE-611 (Improper Restriction of XML External Entity Reference)
- **Tags:** iot

## Description

cgi-bin/xmlstatus.cgi in Gucralp MAN-EAM-0003 3.2.4 is vulnerable to an XML External Entity (XXE) issue via XML file upload, which leads to local file disclosure.

## CrowdSec analysis

[CVE-2022-38840](https://euvd.enisa.europa.eu/vulnerability/CVE-2022-38840) is an XML External Entity (XXE) vulnerability in the cgi-bin/xmlstatus.cgi component of Gucralp MAN-EAM-0003 version 3.2.4, which allows remote attackers to upload malicious XML files and access sensitive local files on the server. This flaw could be exploited to disclose confidential information, posing a significant risk to data security.

CrowdSec has been tracking this vulnerability and its exploits since 15th of October 2025.

CrowdSec network observations suggest that most exploitation of CVE-2022-38840 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental.
CrowdSec network telemetry also shows that exploitation of CVE-2022-38840 has significantly declined over the past week. Attack volumes are well below the long-term average, suggesting attackers are rapidly losing interest. The vulnerability appears to be falling out of active use across most threat landscapes.

Attackers exploit the `/cgi-bin/xmlstatus.cgi` endpoint by uploading specially crafted XML files containing external entity references, enabling them to read sensitive files from the server via XML External Entity (XXE) injection.

## Timeline

- 2023-04-16: CVE Published. CVE-2022-38840 is published to NVD.
- 2025-10-15: Rule Released. CrowdSec releases a rule to detect CVE-2022-38840 exploitation attempts against the CrowdSec Network.
- 2025-10-16: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2022-38840 for the first time.

## References

- https://drive.google.com/drive/folders/1UG5IcL8fFp9MV0vjd78_cx6iXKda5bpM?usp=sharing
- http://packetstormsecurity.com/files/171439/MAN-EAM-0003-3.2.4-XML-Injection.html
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-38840.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2022-38840) follows observed exploitation activity for CVE-2022-38840. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.