Lucene search

NCSC.chCVE-2022-4780

HistoryDec 29, 2022 - 12:15 a.m.

CVE-2022-4780

2022-12-2900:15:09

CWE-798

NCSC.ch

web.nvd.nist.gov

cve-2022-4780

isos firmware

hardcoded credentials

integrators

security vulnerability

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.5

Confidence

High

EPSS

Percentile

13.0%

JSON

ISOS firmwares from versions 1.81 to 2.00 contain hardcoded credentials from embedded StreamX installer that integrators are not forced to change.

Affected configurations

Nvd

Node

elvexysisos_firmwareRange1.81–2.00

VendorProductVersionCPE
elvexysisos_firmware*cpe:2.3:o:elvexys:isos_firmware:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
elvexys	isos_firmware	*	cpe:2.3:o:elvexys:isos_firmware::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "ISOS",
    "vendor": "elvexys",
    "versions": [
      {
        "lessThanOrEqual": "2.00",
        "status": "affected",
        "version": "1.81",
        "versionType": "patch"
      }
    ]
  }
]

References

elvexys.com/products/xpg-gateway-rtu-protocol-converter/isos-release-notes/

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.5

Confidence

High

EPSS

Percentile

13.0%

JSON

Related for CVE-2022-4780