mirror of
https://github.com/fkie-cad/nvd-json-data-feeds.git
synced 2025-06-07 05:28:59 +00:00
100 lines
3.4 KiB
JSON
100 lines
3.4 KiB
JSON
{
|
|
"id": "CVE-2022-30274",
|
|
"sourceIdentifier": "cve@mitre.org",
|
|
"published": "2022-07-26T23:15:08.253",
|
|
"lastModified": "2022-08-02T19:26:58.617",
|
|
"vulnStatus": "Analyzed",
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "The Motorola ACE1000 RTU through 2022-05-02 uses ECB encryption unsafely. It can communicate with an XRT LAN-to-radio gateway by means of an embedded client. Credentials for accessing this gateway are stored after being encrypted with the Tiny Encryption Algorithm (TEA) in ECB mode using a hardcoded key. Similarly, the ACE1000 RTU can route MDLC traffic over Extended Command and Management Protocol (XCMP) and Network Layer (XNL) networks via the MDLC driver. Authentication to the XNL port is protected by TEA in ECB mode using a hardcoded key."
|
|
},
|
|
{
|
|
"lang": "es",
|
|
"value": "Motorola ACE1000 RTU versiones hasta 02-05-2022, usa el cifrado ECB de forma no segura. Puede comunicarse con una pasarela XRT de LAN a radio por medio de un cliente integrado. Las credenciales para acceder a esta pasarela son almacenadas despu\u00e9s de ser encriptadas con el algoritmo de encriptaci\u00f3n Tiny (TEA) en modo ECB usando una clave embebida. Del mismo modo, la RTU ACE1000 puede rutar el tr\u00e1fico MDLC a trav\u00e9s de las redes Extended Command and Management Protocol (XCMP) y Network Layer (XNL) por medio del controlador MDLC. La autenticaci\u00f3n al puerto XNL est\u00e1 protegida por TEA en modo ECB usando una clave embebida"
|
|
}
|
|
],
|
|
"metrics": {
|
|
"cvssMetricV31": [
|
|
{
|
|
"source": "nvd@nist.gov",
|
|
"type": "Primary",
|
|
"cvssData": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"attackVector": "NETWORK",
|
|
"attackComplexity": "LOW",
|
|
"privilegesRequired": "NONE",
|
|
"userInteraction": "NONE",
|
|
"scope": "UNCHANGED",
|
|
"confidentialityImpact": "HIGH",
|
|
"integrityImpact": "HIGH",
|
|
"availabilityImpact": "HIGH",
|
|
"baseScore": 9.8,
|
|
"baseSeverity": "CRITICAL"
|
|
},
|
|
"exploitabilityScore": 3.9,
|
|
"impactScore": 5.9
|
|
}
|
|
]
|
|
},
|
|
"weaknesses": [
|
|
{
|
|
"source": "nvd@nist.gov",
|
|
"type": "Primary",
|
|
"description": [
|
|
{
|
|
"lang": "en",
|
|
"value": "CWE-798"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"configurations": [
|
|
{
|
|
"operator": "AND",
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:motorola:ace1000_firmware:-:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "D94120E5-38DE-44EF-B1D6-C418DC816D25"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": false,
|
|
"criteria": "cpe:2.3:h:motorola:ace1000:-:*:*:*:*:*:*:*",
|
|
"matchCriteriaId": "D16356CC-9056-4675-8DBE-EF395A5529E8"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-06",
|
|
"source": "cve@mitre.org",
|
|
"tags": [
|
|
"Mitigation",
|
|
"Third Party Advisory",
|
|
"US Government Resource"
|
|
]
|
|
},
|
|
{
|
|
"url": "https://www.forescout.com/blog/",
|
|
"source": "cve@mitre.org",
|
|
"tags": [
|
|
"Not Applicable"
|
|
]
|
|
}
|
|
]
|
|
} |