PT-2022-25244 · Unknown · Industrial Edge Management

Published 2022-10-11 · Updated 2022-10-12 · CVE-2022-40147

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Industrial Edge Management versions prior to V1.5.1

Description A vulnerability has been identified in the affected software where it does not properly validate the server certificate when initiating a TLS connection. This could allow an attacker to spoof a trusted entity by interfering in the communication path between the client and the intended server.

Recommendations For versions prior to V1.5.1, update to version V1.5.1 or later to resolve the issue. As a temporary workaround, consider restricting TLS connections to trusted servers or implementing additional validation mechanisms for server certificates until a patch is available.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2022-40147

Affected Products

Industrial Edge Management

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2022-40147 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-649853.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-40147 · Vendor Advisory
• https://t.me/cibsecurity/51109 · Telegram Post