Paper/Archive/CVE-2022-25922

CVE-2022-25922

Power Line Communications PLC4TRUCKS — ICSA-22-063-01 Missing Authentication for Critical Function in Trailer Power Line Communications (PLC) J2497

EPSS 1%CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (NVD)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 68.2.682 × 2013.6 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Power Line Communications PLC4TRUCKS J2497 trailer brake controllers implement diagnostic functions which can be invoked by replaying J2497 messages. There is no authentication or authorization for these functions.

Affected

ProductAffectedFixed inSource

PLC4TRUCKSJ2497 –CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

icscert (CNA)6.1CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refcisa.gov/uscert/ics/advisories/icsa-22-063-01