PT-2022-3621 · Schneider Electric · Acti9 Powertag Link C

Published 2022-07-12 · Updated 2022-07-23 · CVE-2022-34754

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Acti9 PowerTag Link C (A9XELC10-A) versions 1.7.5 and prior Acti9 PowerTag Link C (A9XELC10-B) versions 2.12.0 and prior

Description The issue is related to improper privilege management, which could allow an attacker to elevate their functionality by guessing credentials. This is a result of the vulnerable software's inability to properly manage privileges.

Recommendations For Acti9 PowerTag Link C (A9XELC10-A) versions 1.7.5 and prior, update to a version later than V1.7.5 to resolve the issue. For Acti9 PowerTag Link C (A9XELC10-B) versions 2.12.0 and prior, update to a version later than V2.12.0 to resolve the issue. As a temporary workaround, consider restricting access to the affected module to minimize the risk of exploitation.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

BDU:2022-04406

CVE-2022-34754

Affected Products

Acti9 Powertag Link C

References · 8

• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-193-03&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-193-03_Acti9_PowerTag_Link_C_Security_Notification.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-34754 · Security Note
• https://osv.dev/vulnerability/CVE-2022-34754 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04406 · Security Note
• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-193-03&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-193-03_Acti9_PowerTag_Link_C_Security_Notification.pdf · Note
• https://t.me/cibsecurity/46217 · Telegram Post
• https://t.me/cvenotify/33646 · Telegram Post
• https://t.me/cvenotify/33032 · Telegram Post