Improper access control in Siemens products - CVE-2022-45937

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU70377

Improper access control in Siemens products - CVE-2022-45937

Published: December 15, 2022


Vulnerability identifier: #VU70377
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-45937
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A remote user can download sensitive information from the device containing user account credentials and gain unauthorized access to the application.


Affected software

APOGEE PXC Series (P2 Ethernet)
APOGEE PXC Series (BACnet)
TALON TC Series (BACnet)

How to mitigate CVE-2022-45937

Install updates from vendor's website.

APOGEE PXC Series (P2 Ethernet) - update to 2.8.20
APOGEE PXC Series (BACnet) - update to 3.5.5
TALON TC Series (BACnet) - update to 3.5.5

External References

Related Security Bulletins