PT-2022-3470 · Elcomplus · Elcomplus Smartics

Michael Heinzl · Published 2022-06-23 · Updated 2023-06-27 · CVE-2022-2088

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Elcomplus SmartICS version 2.3.4.0

Description The issue is related to inadequate access control in the Elcomplus SmartICS platform, which can be exploited by a remote attacker to terminate any process in the system. An authenticated user with admin privileges may be able to terminate any process on the system.

Recommendations For Elcomplus SmartICS version 2.3.4.0, consider restricting admin privileges to minimize the risk of exploitation until a patch is available. As a temporary workaround, limit the ability of authenticated users to terminate processes in the system. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2022-04249

CVE-2022-2088

Affected Products

Elcomplus Smartics

References · 6

• https://osv.dev/vulnerability/CVE-2022-2088 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04249 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-2088 · Security Note
• https://t.me/cibsecurity/45199 · Telegram Post
• https://t.me/cvenotify/32738 · Telegram Post
• https://cisa.gov/uscert/ics/advisories/icsa-22-174-05 · Note