PT-2021-7266 · Keysight · Keysight N6841A Rf Sensor+1

Rgod · Published 2021-12-30 · Updated 2023-06-27 · CVE-2022-1661

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Keysight N6841A RF Sensor versions (affected versions not specified) Keysight N6854A Geo Location Server versions (affected versions not specified)

Description The issue is related to directory traversal errors in the UserFirmwareRequestHandler class implementation of the Keysight N6841A RF Sensor and Keysight N6854A Geo Location Server firmware. This may allow a remote attacker to obtain unauthorized access to protected information. The vulnerability can be exploited to disclose arbitrary operating system files.

Recommendations For Keysight N6841A RF Sensor, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Keysight N6854A Geo Location Server, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Relative Path Traversal

Path traversal

Weakness Enumeration

CWE-23

CWE-22

Related Identifiers

BDU:2022-04689

CVE-2022-1661

ZDI-22-805

Affected Products

Keysight N6841A Rf Sensor

Keysight N6854A Geo Location Server

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2022-1661 · Security Note
• https://osv.dev/vulnerability/CVE-2022-1661 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04689 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-22-805 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-CAN-15525 · Note
• https://keysight.com/ru/ru/lib/software-detail/computer-software/n6854a-geolocation-server-and-n6841a-rf-sensor-software-sw319.html · Note
• https://cisa.gov/uscert/ics/advisories/icsa-22-146-01 · Note