by Kastro
Paper/Archive/CVE-2022-47911

CVE-2022-47911

Sewio RTLS Studio — CVE-2022-47911

EPSS 1%CVSS 9.1
critical.is priorityof 100
41
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 69.1.691 × 2013.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 does not properly validate the input module name to the backup services of the software. This could allow a remote attacker to access sensitive functions of the application and execute arbitrary system commands.

Affected

ProductAffectedFixed inSource
RTLS Studio2.0.0 – 2.6.2–CNA

Scores by source

icscert (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refcisa.gov/uscert/ics/advisories/icsa-23-012-01