PT-2022-4703 · Cognex · Cognex 3D-A1000 Dimensioning System

Brandon Park + 3 · CVE-2022-1368 · Published 2022-09-06 · Updated 2022-09-12

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cognex 3D-A1000 Dimensioning System versions 1.0.3 and prior

Description The issue is related to missing authentication for critical functions, allowing unauthorized users to change the operator account password via web server commands. This can be achieved by monitoring web socket communications from an unauthenticated session, potentially enabling an attacker to escalate privileges to match those of the compromised account.

Recommendations For versions 1.0.3 and prior, consider disabling web server commands related to password changes until a patch is available. Restrict access to the web interface to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2022-05593

CVE-2022-1368

Affected Products

Cognex 3D-A1000 Dimensioning System

References · 4

• https://osv.dev/vulnerability/CVE-2022-1368 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-05593 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-1368 · Security Note
• https://cisa.gov/uscert/ics/advisories/icsa-22-249-03 · Note