Authentication bypass using an alternate path or channel in Saia Burgess PG5 PCD - CVE-2022-30319
Published: July 27, 2022
Vulnerability identifier: #VU65803
CSH Severity: Low
CVSS v4: 7.2 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-30319
CWE-ID: CWE-288
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to the affected product uses the S-Bus protocol with authentication functions that can be controlled by the client MAC and IP. A remote attacker on the local network can spoof the MAC and IP of an authenticated client and manipulate the controller configuration.
Affected software
Saia Burgess PG5 PCD
How to mitigate CVE-2022-30319
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.