PT-2022-16853 · Haas · Haas Controller

Francesco Sortino + 1 · Published 2022-10-28 · Updated 2022-11-02 · CVE-2022-2475

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Haas Controller version 100.20.000.1110

Description The issue is related to insufficient granularity of access control when using the "Ethernet Q Commands" service. This allows any user to write macros into registers outside of the authorized accessible range, potentially enabling access to privileged resources or resources out of context.

Recommendations For Haas Controller version 100.20.000.1110, consider restricting access to the "Ethernet Q Commands" service to minimize the risk of exploitation. As a temporary workaround, limit the ability of users to write macros into registers outside of their authorized accessible range until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-1220

Related Identifiers

CVE-2022-2475

Affected Products

Haas Controller

References · 4

• https://osv.dev/vulnerability/CVE-2022-2475 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-2475 · Security Note
• https://cisa.gov/uscert/ics/advisories/icsa-22-298-01 · Note
• https://t.me/cibsecurity/52245 · Telegram Post