Lucene search

SchneiderCVELIST:CVE-2022-32515

HistoryJan 30, 2023 - 12:00 a.m.

CVE-2022-32515

2023-01-3000:00:00

CWE-307

schneider

www.cve.org

cwe-307

excessive authentication attempts

brute force attacks

admin account takeover

conext combox

CVSS3

8.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

AI Score

9.7

Confidence

High

EPSS

0.002

Percentile

58.5%

JSON

A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could cause brute force attacks to take over the admin account when the product does not implement a rate limit mechanism on the admin authentication form. Affected Products: Conext™ ComBox (All Versions)

CNA Affected

[
  {
    "vendor": "Schneider Electric",
    "product": "Conext™ ComBox",
    "versions": [
      {
        "version": "All Versions",
        "status": "affected"
      }
    ]
  }
]

References

download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-165-03_ConextCombox_Security_Notification.pdf

CVSS3

8.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

AI Score

9.7

Confidence

High

EPSS

0.002

Percentile

58.5%

JSON

Related for CVELIST:CVE-2022-32515