PT-2022-24489 · Patlite · Patlite Nh-Fb

Published 2022-08-29 · Updated 2024-08-03 · CVE-2022-38625

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Patlite NH-FB versions 1.46 and below

Description The issue is related to insufficient firmware validation during the upgrade firmware file upload process. This allows authenticated attackers to create and upload their own custom-built firmware and inject malicious code. The vendor considers this a design choice rather than a vulnerability.

Recommendations For Patlite NH-FB versions 1.46 and below, as a temporary workaround, consider restricting access to the firmware upgrade process to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2022-38625

Affected Products

Patlite Nh-Fb

References · 11

• https://osv.dev/vulnerability/CVE-2022-38625 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-38625 · Security Note
• https://patlite.com/network-products/lineup/nh-fb.html · Vendor Advisory
• https://t.me/cvenotify/35508 · Telegram Post
• https://gist.github.com/Nwqda/dfad4e11b545dd40aebca6031d202f66 · Note
• https://t.me/cvenotify/35383 · Telegram Post
• https://t.me/cvenotify/88754 · Telegram Post
• https://t.me/cvenotify/35664 · Telegram Post
• https://youtube.com/watch?v=4r9FH6U2VR8 · Note
• https://t.me/cibsecurity/49012 · Telegram Post
• https://t.me/cvenotify/86426 · Telegram Post