PT-2022-3549 · Aethon · Aethon Tug Home Base Server

Published 2022-04-12 · Updated 2022-10-21 · CVE-2022-26423

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:C/A:N

Name of the Vulnerable Software and Affected Versions Aethon TUG Home Base Server versions prior to version 24

Description The issue is related to weaknesses in the authorization procedure of the server. It allows a remote attacker to gain unauthorized access to hashed user credentials.

Recommendations For versions prior to 24, update to version 24 or later to resolve the issue.

Fix

Improper Access Control

Missing Authorization

Information Disclosure

Weakness Enumeration

CWE-284

CWE-862

CWE-200

Related Identifiers

BDU:2022-04333

CVE-2022-26423

Affected Products

Aethon Tug Home Base Server

References · 5

• https://bdu.fstec.ru/vul/2022-04333 · Security Note
• https://osv.dev/vulnerability/CVE-2022-26423 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-26423 · Security Note
• https://safe-surf.ru/upload/VULN/VULN-20220419.8.pdf · Security Note
• https://cisa.gov/uscert/ics/advisories/icsa-22-102-05 · Note