IcscertCVELIST:CVE-2022-1669CVE-2022-1669 Circutor COMPACT DC-S BASIC
6.8 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H
8.3 High
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
31.8%
A buffer overflow vulnerability has been detected in the firewall function of the device management web portal. The device runs a CGI binary (index.cgi) to offer a management web application. Once authenticated with valid credentials in this web portal, a potential attacker could submit any “Address” value and it would be copied to a second variable with a “strcpy” vulnerable function without checking its length. Because of this, it is possible to send a long address value to overflow the process stack, controlling the function return address.
CNA Affected
[
{
"product": "COMPACT DC-S BASIC",
"vendor": "CIRCUTOR",
"versions": [
{
"status": "affected",
"version": "CIR_CDC_v1.2.17"
}
]
}
]Related
6.8 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H
8.3 High
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
31.8%