PT-2022-20040 · Cms8000 · Cms8000

Published 2022-09-13 · Updated 2022-09-14 · CVE-2022-3027

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Medium

Base vector

AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions CMS8000 (affected versions not specified)

Description The CMS8000 device does not properly control or sanitize the SSID name of a new Wi-Fi access point. A threat actor could create an SSID with a malicious name, including non-standard characters that, when the device attempts connecting to the malicious SSID, the device can be exploited to write arbitrary files or display incorrect information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2022-3027

Affected Products

Cms8000

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2022-3027 · Security Note
• https://t.me/cvenotify/36095 · Telegram Post
• https://cisa.gov/uscert/ics/advisories/icsma-22-244-01 · Note
• https://t.me/cibsecurity/49646 · Telegram Post