Lucene search
HistorySep 23, 2022 - 4:15 p.m.
CVE-2022-2970
mz automation
libiec61850
vulnerability
input sanitization
memcpy
remote code execution
crash
cve-2022-2970
CVSS3
9.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
0.002
Percentile
60.8%
MZ Automation’s libIEC61850 (versions 1.4 and prior; version 1.5 prior to commit a3b04b7bc4872a5a39e5de3fdc5fbde52c09e10e) does not sanitize input before memcpy is used, which could allow an attacker to crash the device or remotely execute arbitrary code.
Affected configurations
Node
mz-automationlibiec61850Range<1.5.0
| Vendor | Product | Version | CPE |
|---|---|---|---|
| mz-automation | libiec61850 | * | cpe:2.3:a:mz-automation:libiec61850:*:*:*:*:*:*:*:* |
Related
cve
cve
CVE-2022-2970
2022-09-23 16:15:10
osv
osv
CVE-2022-2970
2022-09-23 16:15:10
cvelist
cvelist
CVE-2022-2970 MZ Automation libIEC61850 Stack-Based Buffer Overflow
2022-09-23 15:28:55
prion
prion
Code injection
2022-09-23 16:15:00
ics
ics
MZ Automation libIEC61850
2022-09-08 12:00:00
CVSS3
9.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
0.002
Percentile
60.8%
Related for NVD:CVE-2022-2970