Paper/Archive/CVE-2022-26833

CVE-2022-26833

Open Automation Software OAS Platform — An improper authentication vulnerability exists in the REST API functionality of Open Automation Software OAS Platform V16.00.0121.

EPSS 38%CVSS 9.4

critical.is priorityof 100

CVSS 9.4 (NVD, CNA agree)9.4 / 10 × 3028.2 Not in CISA KEV+300.0 EPSS percentile 98.5.985 × 2019.7 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

An improper authentication vulnerability exists in the REST API functionality of Open Automation Software OAS Platform V16.00.0121. A specially-crafted series of HTTP requests can lead to unauthenticated use of the REST API. An attacker can send a series of HTTP requests to trigger this vulnerability.

Affected

ProductAffectedFixed inSource

OAS PlatformV16.00.0121–CNA

Scores by source

NVD9.4CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

talos (CNA)9.4CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

References

reftalosintelligence.com/vulnerability_reports/TALOS-2022-1513