Lucene search

IcscertCVELIST:CVE-2022-38453

HistorySep 13, 2022 - 2:55 p.m.

CVE-2022-38453 Contec Health CMS8000

2022-09-1314:55:03

CWE-489

icscert

www.cve.org

contec health cms8000

'not stripped'

'debug_info'

vulnerability

reverse engineer

sensitive code

additional vulnerabilities

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N

AI Score

5.2

Confidence

High

EPSS

Percentile

10.4%

JSON

Multiple binary application files on the CMS8000 device are compiled with ‘not stripped’ and ‘debug_info’ compilation settings. These compiler settings greatly decrease the level of effort for a threat actor to reverse engineer sensitive code and identify additional vulnerabilities.

CNA Affected

[
  {
    "product": "CMS8000 CONTEC ICU CCU Vital Signs Patient Monitor",
    "vendor": "Contec Health",
    "versions": [
      {
        "status": "affected",
        "version": "All"
      }
    ]
  }
]

References

www.cisa.gov/uscert/ics/advisories/icsma-22-244-01

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N

AI Score

5.2

Confidence

High

EPSS

Percentile

10.4%

JSON

Related for CVELIST:CVE-2022-38453