by Kastro
Paper/Archive/CVE-2022-1368

CVE-2022-1368

Cognex 3D-A1000 Dimensioning System — Cognex 3D-A1000 Dimensioning System Missing Authentication for Critical Function

EPSS 1.0%CVSS 9.8
critical.is priorityof 100
42
CVSS 9.8 (NVD, CNA agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 62.6.626 × 2012.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The Cognex 3D-A1000 Dimensioning System in firmware version 1.0.3 (3354) and prior is vulnerable to CWE-306: Missing Authentication for Critical Function, which allows unauthorized users to change the operator account password via webserver commands by monitoring web socket communications from an unauthenticated session. This could allow an attacker to escalate privileges to match those of the compromised account.

Affected

ProductAffectedFixed inSource
3D-A1000 Dimensioning Systemall – 1.0.3 (3354)–CNA

Scores by source

icscert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcisa.gov/uscert/ics/advisories/icsa-22-249-03