CVE-2022-2788

2022-08-1921:15:08

CWE-29

CWE-22

[email protected]

web.nvd.nist.gov

emerson electric

proficy machine edition

cve-2022-2788

nvd

cwe-29

path traversal

zipslip

plc

upload procedure

malicious file

7.3 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

0.0004 Low

EPSS

Percentile

13.2%

JSON

Emerson Electric’s Proficy Machine Edition Version 9.80 and prior is vulnerable to CWE-29 Path Traversal: ‘..\Filename’, also known as a ZipSlip attack, through an upload procedure which enables attackers to implant a malicious .BLZ file on the PLC. The file can transfer through the engineering station onto Windows in a way that executes the malicious code.

Affected configurations

NVD

Node

emersonelectric\'s_proficyRange≤9.80machine

CPENameOperatorVersion
emerson:electric\'s_proficyemerson electric's proficyle9.80

CPE	Name	Operator	Version
emerson:electric\'s_proficy	emerson electric's proficy	le	9.80

CNA Affected

[
  {
    "product": "Proficy Machine Edition",
    "vendor": "Emerson Electric",
    "versions": [
      {
        "lessThanOrEqual": "9.80",
        "status": "affected",
        "version": "all",
        "versionType": "custom"
      }
    ]
  }
]