CVE-2022-38453

2022-09-1315:15:08

CWE-489

[email protected]

web.nvd.nist.gov

cms8000

binary application files

not stripped

debug_info

reverse engineering

vulnerabilities

CVSS3

4.4

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

EPSS

Percentile

10.4%

JSON

Multiple binary application files on the CMS8000 device are compiled with ‘not stripped’ and ‘debug_info’ compilation settings. These compiler settings greatly decrease the level of effort for a threat actor to reverse engineer sensitive code and identify additional vulnerabilities.

Affected configurations

Nvd

Node

contechealthcms8000_firmwareMatch-

AND

contechealthcms8000Match-

VendorProductVersionCPE
contechealthcms8000_firmware-cpe:2.3:o:contechealth:cms8000_firmware:-:*:*:*:*:*:*:*
contechealthcms8000-cpe:2.3:h:contechealth:cms8000:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
contechealth	cms8000_firmware	-	cpe:2.3:o:contechealth:cms8000_firmware:-:::::::*
contechealth	cms8000	-	cpe:2.3:h:contechealth:cms8000:-:::::::*