PT-2022-22959 · Frauscher Sensortechnik Gmbh · Fds102

Published 2022-11-02 · Updated 2022-11-05 · CVE-2022-3575

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Frauscher Sensortechnik GmbH FDS102 for FAdC R2 and FAdCi R2 versions 2.8.0 through 2.9.1

Description The issue allows malicious code upload without authentication by using the configuration upload function, which could lead to a complete compromise of the FDS102 device.

Recommendations For versions 2.8.0 through 2.9.1, as a temporary workaround, consider disabling the configuration upload function until a patch is available. Restrict access to the configuration upload feature to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2022-3575

Affected Products

Fds102

References · 4

• https://osv.dev/vulnerability/CVE-2022-3575 · Vendor Advisory
• https://frauscher.com/en/psirt · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3575 · Security Note
• https://t.me/cibsecurity/52484 · Telegram Post