Lucene search

TwcertCVE-2022-38121

HistoryNov 10, 2022 - 3:15 p.m.

CVE-2022-38121

2022-11-1015:15:14

CWE-522

twcert

web.nvd.nist.gov

cve-2022-38121

upsmon pro

plaintext password

user privilege

remote attacker

unprotected configuration file

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.6

Confidence

High

EPSS

0.001

Percentile

44.7%

JSON

UPSMON PRO configuration file stores user password in plaintext under public user directory. A remote attacker with general user privilege can access all users‘ and administrators’ account names and passwords via this unprotected configuration file.

Affected configurations

Nvd

Node

upspowercomupsmon_proMatch2.57

VendorProductVersionCPE
upspowercomupsmon_pro2.57cpe:2.3:a:upspowercom:upsmon_pro:2.57:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
upspowercom	upsmon_pro	2.57	cpe:2.3:a:upspowercom:upsmon_pro:2.57:::::::*

CNA Affected

[
  {
    "vendor": "POWERCOM CO., LTD.",
    "product": "UPSMON PRO",
    "versions": [
      {
        "version": "2.57",
        "status": "affected"
      }
    ]
  }
]

References

www.twcert.org.tw/tw/cp-132-6680-af0aa-1.html

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.6

Confidence

High

EPSS

0.001

Percentile

44.7%

JSON

Related for CVE-2022-38121