Paper/Archive/CVE-2022-41636

CVE-2022-41636

Haas Haas CNC Controller — Communication traffic involving "Ethernet Q Commands" service of Haas Controller version 100.20.000.1110 is transmitted in cleartext.

EPSS 0.5%CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (CNA)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 41.9.419 × 208.4 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Communication traffic involving "Ethernet Q Commands" service of Haas Controller version 100.20.000.1110 is transmitted in cleartext. This allows an attacker to obtain sensitive information being passed to and from the controller.

Affected

ProductAffectedFixed inSource

Haas CNC ControllerVersion 100.20.000.1110–CNA

Scores by source

icscert (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcisa.gov/uscert/ics/advisories/icsa-22-298-01