PT-2022-21739 · L2Blocker · L2Blocker

Published 2022-06-27 · Updated 2022-07-07 · CVE-2022-33202

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions L2Blocker(on-premise) versions 4.8.5 and earlier L2Blocker(Cloud) versions 4.8.5 and earlier

Description The issue allows an adjacent attacker to bypass authentication in the setup screen, potentially leading to unauthorized login, access to stored information, or device malfunction. This is achieved by using alternative paths or channels for the Sensor.

Recommendations For L2Blocker(on-premise) versions 4.8.5 and earlier, update to a version later than 4.8.5 to resolve the issue. For L2Blocker(Cloud) versions 4.8.5 and earlier, update to a version later than 4.8.5 to resolve the issue. As a temporary workaround, consider restricting access to the setup screen to minimize the risk of exploitation.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2022-33202

Affected Products

L2Blocker

References · 5

• https://osv.dev/vulnerability/CVE-2022-33202 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-33202 · Security Note
• https://softcreate.co.jp/news/detail/210 · Vendor Advisory
• https://jvn.jp/en/jp/JVN51464799/index.html · Note
• https://t.me/cibsecurity/45162 · Telegram Post