PT-2022-14126 · Teradici · Pcoip Zero Client

Published 2022-07-28 · Updated 2022-08-05 · CVE-2022-1805

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PCoIP Zero Client (affected versions not specified)

Description The issue arises when connecting to Amazon Workspaces, as the SHA256 presented by the AWS connection provisioner is not fully verified by Zero Clients. This could be exploited by an adversary placing a Man in the Middle (MITM) between a zero client and the AWS session provisioner in the network. The issue is only applicable when connecting to an Amazon Workspace from a PCoIP Zero Client.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2022-1805

Affected Products

Pcoip Zero Client

References · 4

• https://osv.dev/vulnerability/CVE-2022-1805 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-1805 · Security Note
• https://support.hp.com/us-en/document/ish_6545906-6545930-16/hpsbhf03794 · Vendor Advisory
• https://t.me/cibsecurity/47197 · Telegram Post