CVE-2022-2634

CRITICAL

10.0

Descricao

An attacker may be able to execute malicious actions due to the lack of device access protections and device permissions when using the web application. This could lead to uploading python files which can be later executed.

Detalhes CVE

Pontuacao CVSS v3.110.0

SeveridadeCRITICAL

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosNONE

Interacao do usuarioNONE

Publicado8/10/2022

Ultima modificacao11/21/2024

Fontenvd

Avistamentos honeypot0

Produtos afetados

digi:connectport_x2ddigi:connectport_x2d_firmware

Fraquezas (CWE)

CWE-250

Referencias

https://www.cisa.gov/uscert/ics/advisories/icsa-22-216-01(ics-cert@hq.dhs.gov)

https://www.cisa.gov/uscert/ics/advisories/icsa-22-216-01(af854a3a-2127-422b-91ae-364da2661108)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.