by Kastro
Paper/Archive/CVE-2022-43483

CVE-2022-43483

Sewio RTLS Studio — CVE-2022-43483

EPSS 1%CVSS 9.1
critical.is priorityof 100
41
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 69.1.691 × 2013.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 does not properly validate the input module name to the monitor services of the software. This could allow a remote attacker to access sensitive functions of the application and execute arbitrary system commands.

Affected

ProductAffectedFixed inSource
RTLS Studio2.0.0 – 2.6.2–CNA

Scores by source

icscert (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refcisa.gov/uscert/ics/advisories/icsa-23-012-01