Lucene search

Hitachi EnergyCVELIST:CVE-2022-3686

HistoryMar 28, 2023 - 12:57 p.m.

CVE-2022-3686 SDM600 API permission check

2023-03-2812:57:11

CWE-285

Hitachi Energy

www.cve.org

hitachi energy

sdm600

security vulnerability

api permission check

cve-2022-3686

cpe

web services

version 1.2.23000.291

4.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

9.2 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

49.5%

JSON

A vulnerability exists in a SDM600 endpoint.
An attacker could exploit this vulnerability by running multiple parallel requests, the SDM600 web services become busy rendering the application unresponsive.
This issue affects: All SDM600 versions prior to version 1.2 FP3 HF4 (Build Nr. 1.2.23000.291)

List of CPEs:

cpe:2.3:a:hitachienergy:sdm600:1.0:::::::*
cpe:2.3:a:hitachienergy:sdm600:1.1:::::::*
cpe:2.3:a:hitachienergy:sdm600:1.2:::::::*
cpe:2.3:a:hitachienergy:sdm600:1.2.9002.257:::::::*
cpe:2.3:a:hitachienergy:sdm600:1.2.10002.257:::::::*
cpe:2.3:a:hitachienergy:sdm600:1.2.11002.149:::::::*
cpe:2.3:a:hitachienergy:sdm600:1.2.12002.222:::::::*
cpe:2.3:a:hitachienergy:sdm600:1.2.13002.72:::::::*
cpe:2.3:a:hitachienergy:sdm600:1.2.14002.44:::::::*
cpe:2.3:a:hitachienergy:sdm600:1.2.14002.92:::::::*
cpe:2.3:a:hitachienergy:sdm600:1.2.14002.108:::::::*
cpe:2.3:a:hitachienergy:sdm600:1.2.14002.182:::::::*
cpe:2.3:a:hitachienergy:sdm600:1.2.14002.257:::::::*
cpe:2.3:a:hitachienergy:sdm600:1.2.14002.342:::::::*
cpe:2.3:a:hitachienergy:sdm600:1.2.14002.447:::::::*
cpe:2.3:a:hitachienergy:sdm600:1.2.14002.481:::::::*
cpe:2.3:a:hitachienergy:sdm600:1.2.14002.506:::::::*
cpe:2.3:a:hitachienergy:sdm600:1.2.14002.566:::::::*
cpe:2.3:a:hitachienergy:sdm600:1.2.20000.3174:::::::*
cpe:2.3:a:hitachienergy:sdm600:1.2.21000.291:::::::*
cpe:2.3:a:hitachienergy:sdm600:1.2.21000.931:::::::*
cpe:2.3:a:hitachienergy:sdm600:1.2.21000.105:::::::*
cpe:2.3:a:hitachienergy:sdm600:1.2.23000.291:::::::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "SDM600",
    "vendor": "Hitachi Energy",
    "versions": [
      {
        "status": "unaffected",
        "version": "SDM600 1.3"
      },
      {
        "lessThanOrEqual": "SDM600 1.2.*",
        "status": "affected",
        "version": "SDM600 1.2",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "SDM600 1.1.*",
        "status": "affected",
        "version": "SDM600 1.1",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "SDM600 1.0.*",
        "status": "affected",
        "version": "SDM600 1.0",
        "versionType": "custom"
      }
    ]
  }
]

References

search.abb.com/library/Download.aspx?DocumentID=8DBD000138&LanguageCode=en&DocumentPartId=&Action=Launch

4.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

9.2 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

49.5%

JSON

Related for CVELIST:CVE-2022-3686