CVE-2022-1368criticalCWE-306

CVE-2022-1368: falha crítica em Cognex 3D-A1000 Dimensioning System

Cognex 3D-A1000 Dimensioning System Missing Authentication for Critical Function

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar 3D-A1000 Dimensioning System

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.8epss 1.0%
The Cognex 3D-A1000 Dimensioning System in firmware version 1.0.3 (3354) and prior is vulnerable to CWE-306: Missing Authentication for Critical Function, which allows unauthorized users to change the operator account password via webserver commands by monitoring web socket communications from an unauthenticated session. This could allow an attacker to escalate privileges to match those of the compromised account.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
Cognex · 3D-A1000 Dimensioning System
CVEs relacionadas — Cognex 3D-A1000 Dimensioning System

No mesmo produto, das mais perigosas para as menos.

CVE-2022-1525CRITICALCognex 3D-A1000 Dimensioning System Client-Side Enforcement of Server-Side SecurityEPSS 0.9%CVE-2022-1522MEDIUMCognex 3D-A1000 Dimensioning System Improper Output Neutralization for LogsEPSS 0.6%