Lucene search

HpCVE-2022-1805

HistoryJul 28, 2022 - 3:15 p.m.

CVE-2022-1805

2022-07-2815:15:07

CWE-295

web.nvd.nist.gov

cve-2022-1805

amazon workspaces

sha256

aws

mitm

pcoip zero client

nvd

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.7

Confidence

High

EPSS

0.002

Percentile

53.5%

JSON

When connecting to Amazon Workspaces, the SHA256 presented by AWS connection provisioner is not fully verified by Zero Clients. The issue could be exploited by an adversary that places a MITM (Man in the Middle) between a zero client and AWS session provisioner in the network. This issue is only applicable when connecting to an Amazon Workspace from a PCoIP Zero Client.

Affected configurations

Nvd

Node

teradicitera2_pcoip_zero_client_firmwareRange<22.01.5

teradicitera2_pcoip_zero_client_firmwareMatch22.04

AND

teradicitera2_pcoip_zero_clientMatch-

VendorProductVersionCPE
teradicitera2_pcoip_zero_client_firmware*cpe:2.3:o:teradici:tera2_pcoip_zero_client_firmware:*:*:*:*:*:*:*:*
teradicitera2_pcoip_zero_client_firmware22.04cpe:2.3:o:teradici:tera2_pcoip_zero_client_firmware:22.04:*:*:*:*:*:*:*
teradicitera2_pcoip_zero_client-cpe:2.3:h:teradici:tera2_pcoip_zero_client:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
teradici	tera2_pcoip_zero_client_firmware	*	cpe:2.3:o:teradici:tera2_pcoip_zero_client_firmware::::::::
teradici	tera2_pcoip_zero_client_firmware	22.04	cpe:2.3:o:teradici:tera2_pcoip_zero_client_firmware:22.04:::::::*
teradici	tera2_pcoip_zero_client	-	cpe:2.3:h:teradici:tera2_pcoip_zero_client:-:::::::*

CNA Affected

[
  {
    "product": "Tera2 Zero Client",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Firmware version 22.04 and earlier"
      }
    ]
  }
]

References

support.hp.com/us-en/document/ish_6545906-6545930-16/hpsbhf03794

Social References

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.7

Confidence

High

EPSS

0.002

Percentile

53.5%

JSON

Related for CVE-2022-1805