PT-2022-3403 · Unknown · Meridian Cooperative Utility

Brandon Roach · Published 2022-06-24 · Updated 2022-07-06 · CVE-2022-29578

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Meridian Cooperative Utility Software versions 22.02 and 22.03

Description The issue is related to inadequate access control in the Meridian Cooperative Utility Software, allowing remote attackers to obtain sensitive user information, including name, address, and daily energy usage.

Recommendations For Meridian Cooperative Utility Software versions 22.02 and 22.03, update to a version that addresses the access control issue to prevent remote attackers from obtaining sensitive information. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Improper Authentication

Weakness Enumeration

CWE-284

CWE-287

Related Identifiers

BDU:2022-04177

CVE-2022-29578

Affected Products

Meridian Cooperative Utility

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2022-29578 · Security Note
• https://bdu.fstec.ru/vul/2022-04177 · Security Note
• https://osv.dev/vulnerability/CVE-2022-29578 · Vendor Advisory
• https://t.me/cibsecurity/45104 · Telegram Post
• https://cisa.gov/uscert/ics/advisories/icsa-22-165-02 · Note
• https://t.me/cvenotify/32131 · Telegram Post