CVE-2022-38466

2022-09-1310:15:10

CWE-276

CWE-284

[email protected]

web.nvd.nist.gov

cve-2022-38466

coreshield

one-way gateway

software

vulnerability

local attacker

privilege escalation

nvd

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.4 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

A vulnerability has been identified in CoreShield One-Way Gateway (OWG) Software (All versions < V2.2). The default installation sets insecure file permissions that could allow a local attacker to escalate privileges to local administrator.

Affected configurations

NVD

Node

siemenscoreshield_one-way_gatewayRange<2.2

CPENameOperatorVersion
siemens:coreshield_one-way_gatewaysiemens coreshield one-way gatewaylt2.2

CPE	Name	Operator	Version
siemens:coreshield_one-way_gateway	siemens coreshield one-way gateway	lt	2.2

CNA Affected

[
  {
    "product": "CoreShield One-Way Gateway (OWG) Software",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions < V2.2"
      }
    ]
  }
]