PT-2022-4702 · Cognex · Cognex 3D-A1000 Dimensioning System

Brandon Park + 3 · Published 2022-09-06 · Updated 2022-09-12 · CVE-2022-1525

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cognex 3D-A1000 Dimensioning System versions 1.0.3 (3354) and prior

Description The issue is related to the implementation of security functions on the client-side of the Cognex 3D-A1000 Dimensioning System. This could allow a remote attacker to elevate their privileges. The vulnerability is associated with the client-side enforcement of server-side security, which may enable attackers to bypass web access controls by inspecting and modifying the source code of password-protected web elements.

Recommendations For versions 1.0.3 (3354) and prior, consider disabling web access to password-protected elements until a patch is available. Restrict access to the source code of web elements to minimize the risk of exploitation. Avoid using password-protected web elements in the affected system until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-602

Related Identifiers

BDU:2022-05592

CVE-2022-1525

Affected Products

Cognex 3D-A1000 Dimensioning System

References · 5

• https://osv.dev/vulnerability/CVE-2022-1525 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-1525 · Security Note
• https://bdu.fstec.ru/vul/2022-05592 · Security Note
• https://t.me/cvenotify/36029 · Telegram Post
• https://cisa.gov/uscert/ics/advisories/icsa-22-249-03 · Note