Lucene search

[email protected]CVE-2022-26392

HistorySep 09, 2022 - 3:15 p.m.

CVE-2022-26392

2022-09-0915:15:00

CWE-134

[email protected]

web.nvd.nist.gov

baxter spectrum wbm

vulnerability

cve-2022-26392

format string attack

nvd

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

6.9 Medium

AI Score

Confidence

High

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

27.2%

JSON

The Baxter Spectrum WBM (v16, v16D38) and Baxter Spectrum WBM (v17, v17D19, v20D29 to v20D32) when in superuser mode is susceptible to format string attacks via application messaging. An attacker could use this to read memory in the WBM to access sensitive information.

CPENameOperatorVersion
baxter:spectrum_wireless_battery_module_firmwarebaxter spectrum wireless battery module firmwarele20d32
baxter:spectrum_wireless_battery_module_firmwarebaxter spectrum wireless battery module firmwareeq16
baxter:spectrum_wireless_battery_module_firmwarebaxter spectrum wireless battery module firmwareeq16d38
baxter:spectrum_wireless_battery_module_firmwarebaxter spectrum wireless battery module firmwareeq17
baxter:spectrum_wireless_battery_module_firmwarebaxter spectrum wireless battery module firmwareeq17d19
baxter:sigma_spectrum_35700bax_firmwarebaxter sigma spectrum 35700bax firmwareeq-
baxter:sigma_spectrum_35700bax2_firmwarebaxter sigma spectrum 35700bax2 firmwareeq-
baxter:baxter_spectrum_iq_35700bax3_firmwarebaxter baxter spectrum iq 35700bax3 firmwareeq-

CPE	Name	Operator	Version
baxter:spectrum_wireless_battery_module_firmware	baxter spectrum wireless battery module firmware	le	20d32
baxter:spectrum_wireless_battery_module_firmware	baxter spectrum wireless battery module firmware	eq	16
baxter:spectrum_wireless_battery_module_firmware	baxter spectrum wireless battery module firmware	eq	16d38
baxter:spectrum_wireless_battery_module_firmware	baxter spectrum wireless battery module firmware	eq	17
baxter:spectrum_wireless_battery_module_firmware	baxter spectrum wireless battery module firmware	eq	17d19
baxter:sigma_spectrum_35700bax_firmware	baxter sigma spectrum 35700bax firmware	eq	-
baxter:sigma_spectrum_35700bax2_firmware	baxter sigma spectrum 35700bax2 firmware	eq	-
baxter:baxter_spectrum_iq_35700bax3_firmware	baxter baxter spectrum iq 35700bax3 firmware	eq	-

References

www.cisa.gov/uscert/ics/advisories/icsma-22-251-01

www.us-cert.gov/ics/advisories/icsma-22-xxx-xx

Social References

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

6.9 Medium

AI Score

Confidence

High

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

27.2%

JSON

Related for CVE-2022-26392

prion1 thn1 ics1 rapid7blog1