PT-2024-11551 · Priva · Priva Topcontrol Suite

Victor Pasman · Published 2024-01-02 · Updated 2024-01-09 · CVE-2022-3010

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Priva TopControl Suite (affected versions not specified)

Description The Priva TopControl Suite contains predictable credentials for the SSH service, based on the Serial number. This makes it possible for an attacker to calculate the login credentials for the Priva TopControl suite.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-916

CWE-1391

Related Identifiers

CVE-2022-3010

Affected Products

Priva Topcontrol Suite

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2022-3010 · Security Note
• https://osv.dev/vulnerability/CVE-2022-3010 · Vendor Advisory
• https://csirt.divd.nl/DIVD-2022-00035 · Note
• https://cisa.gov/news-events/ics-advisories/icsa-22-356-01 · Note
• https://twitter.com/CVEnew/status/1742254088912265552 · Twitter Post
• https://t.me/cibsecurity/74188 · Telegram Post
• https://csirt.divd.nl/CVE-2022-3010 · Note
• https://t.me/cvenotify/66774 · Telegram Post