Missing Authentication for Critical Function in J2497 - CVE-2022-25922
Published: March 7, 2022
Vulnerability identifier: #VU61039
CSH Severity: Low
CVSS v4: 5.2 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-25922
CWE-ID: CWE-306
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an attacker with pysical access to compromise the target system.
The vulnerability exists due to trailer brake controllers implement diagnostic functions which can be invoked by replaying J2497 messages.
Affected software
J2497
How to mitigate CVE-2022-25922
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.