René Helmke 7791f18b51 bootstrap
2023-05-16 16:09:41 +02:00

100 lines
3.5 KiB
JSON

{
"id": "CVE-2022-30269",
"sourceIdentifier": "cve@mitre.org",
"published": "2022-07-26T23:15:08.097",
"lastModified": "2022-08-02T20:03:02.587",
"vulnStatus": "Analyzed",
"descriptions": [
{
"lang": "en",
"value": "Motorola ACE1000 RTUs through 2022-05-02 mishandle application integrity. They allow for custom application installation via either STS software, the C toolkit, or the ACE1000 Easy Configurator. In the case of the Easy Configurator, application images (as PLX/DAT/APP/CRC files) are uploaded via the Web UI. In case of the C toolkit, they are transferred and installed using SFTP/SSH. In each case, application images were found to have no authentication (in the form of firmware signing) and only relied on insecure checksums for regular integrity checks."
},
{
"lang": "es",
"value": "Motorola ACE1000 RTUs versiones hasta 02-05-2022, manejan inapropiadamente la integridad de las aplicaciones. Permiten la instalaci\u00f3n de aplicaciones personalizadas por medio del software STS, el kit de herramientas C o el ACE1000 Easy Configurator. En el caso del Easy Configurator, las im\u00e1genes de las aplicaciones (como archivos PLX/DAT/APP/CRC) son cargadas por medio de la Interfaz de Usuario Web. En el caso del kit de herramientas C, son transferidas e instaladas mediante SFTP/SSH. En cada caso, las im\u00e1genes de la aplicaci\u00f3n no ten\u00edan autenticaci\u00f3n (en forma de firma de firmware) y s\u00f3lo eran basadas en sumas de comprobaci\u00f3n no seguras para las comprobaciones de integridad peri\u00f3dicas"
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "nvd@nist.gov",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9
}
]
},
"weaknesses": [
{
"source": "nvd@nist.gov",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-345"
}
]
}
],
"configurations": [
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:motorola:ace1000_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D94120E5-38DE-44EF-B1D6-C418DC816D25"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:h:motorola:ace1000:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D16356CC-9056-4675-8DBE-EF395A5529E8"
}
]
}
]
}
],
"references": [
{
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-06",
"source": "cve@mitre.org",
"tags": [
"Mitigation",
"Third Party Advisory",
"US Government Resource"
]
},
{
"url": "https://www.forescout.com/blog/",
"source": "cve@mitre.org",
"tags": [
"Not Applicable"
]
}
]
}