CVE-2022-1368
Assigner: icscert
Published: 2022-09-06T22:19:13
State: PUBLISHED
affected: product: 3D-A1000 Dimensioning System
vendor: Cognex
versions: lessThanOrEqual: 1.0.3 (3354)
status: affected
version: all
versionType: custom
credits: value: Tri Quach, Shanil Prasad, Brandon Park, and Nishith Sinha reported these vulnerabilities to CISA.
descriptions: value: The Cognex 3D-A1000 Dimensioning System in firmware version 1.0.3 (3354) and prior is vulnerable to CWE-306: Missing Authentication for Critical Function, which allows unauthorized users to change the operator account password via webserver commands by monitoring web socket communications from an unauthenticated session. This could allow an attacker to escalate privileges to match those of the compromised account.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
problemTypes: descriptions: cweId: CWE-306
description: CWE-306 Missing Authentication for Critical Function
type: CWE
source: discovery: UNKNOWN
title: Cognex 3D-A1000 Dimensioning System Missing Authentication for Critical Function
x_generator: engine: Vulnogram 0.0.9