PT-2023-13020 · Landis+Gyr · Landis+Gyr E850

Aarón Flecha Menéndez + 2 · Publicado 2023-02-01 · Atualizado 2023-02-10 · CVE-2022-3083

Positive Technologies (AI Summary)

CVSS v3.1

3.9

Baixa

Vetor base

AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Landis+Gyr E850 (ZMQ200) versions all

Description The device's web application navigation depends on the value of the session cookie. If an attacker changes the session cookie values, the web application could become inaccessible for the user. This issue is related to the reliance on cookies without validation and integrity.

Recommendations For all versions, consider implementing cookie validation and integrity checks to prevent unauthorized modifications. As a temporary workaround, restrict access to the web application to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-565

CWE-784

Identificadores relacionados

CVE-2022-3083

Produtos afetados

Landis+Gyr E850

Referências · 4

• https://t.me/cvenotify/43378 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2022-3083 · Nota de Segurança
• https://cisa.gov/uscert/ics/advisories/icsa-23-026-07 · Nota
• https://t.me/cibsecurity/57360 · Publicação no Telegram