PT-2023-3038 · Unknown · Onewireless

Published 2023-05-30 · Updated 2023-06-06 · CVE-2022-46361

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions OneWireless versions up to 322.1

Description The issue allows an attacker with physical access to the system to execute unwanted commands by plugging in a USB device. A malicious user could also enter a system command along with a backup configuration, resulting in the execution of unwanted commands. This can be exploited remotely, potentially allowing an attacker to execute arbitrary commands.

Recommendations For versions up to 322.1, update to version 322.2 to resolve the issue. As a temporary workaround, consider restricting physical access to the system and limiting the ability to plug in USB devices. Restrict access to system commands and backup configurations to minimize the risk of exploitation.

Fix

Command Injection

OS Command Injection

Weakness Enumeration

CWE-77

CWE-78

Related Identifiers

BDU:2023-03103

CVE-2022-46361

Affected Products

Onewireless

References · 7

• https://bdu.fstec.ru/vul/2023-03103 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-46361 · Security Note
• https://osv.dev/vulnerability/CVE-2022-46361 · Vendor Advisory
• https://cisa.gov/news-events/ics-advisories/icsa-23-075-06 · Note
• https://t.me/cvenotify/51379 · Telegram Post
• https://t.me/cvenotify/51393 · Telegram Post
• https://process.honeywell.com · Note