PT-2022-16842 · Haas · Haas Controller

Francesco Sortino + 1 · Published 2022-10-28 · Updated 2022-11-02 · CVE-2022-2474

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Haas Controller version 100.20.000.1110

Description The issue concerns the "Ethernet Q Commands" service in the Haas Controller, where authentication is currently unsupported. This allows any user on the same network segment as the controller, including those connected remotely, to access the service and write unauthorized macros to the device.

Recommendations For Haas Controller version 100.20.000.1110, consider disabling the "Ethernet Q Commands" service until a patch is available to prevent unauthorized access and macro writing. Restrict access to the network segment where the controller is located to minimize the risk of exploitation.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2022-2474

Affected Products

Haas Controller

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2022-2474 · Security Note
• https://osv.dev/vulnerability/CVE-2022-2474 · Vendor Advisory
• https://t.me/cibsecurity/52241 · Telegram Post
• https://cisa.gov/uscert/ics/advisories/icsa-22-298-01 · Note