CVE-2022-26519
Assigner: icscert
Published: 2022-04-20T15:30:36
State: PUBLISHED
affected: product: Hills ComNav
vendor: Interlogix
versions: lessThan: 3002-19
status: affected
version: unspecified
versionType: custom
credits: value: Jacob Thompson of Flinders University, Dr. Paul Gardner-Stephen of Flinders University and DEWC Systems, and Dr. Samuel Chenoweth of Defence Science and Technology Group reported these vulnerabilities to Carrier.
descriptions: value: There is no limit to the number of attempts to authenticate for the local configuration pages for the Hills ComNav Version 3002-19 interface, which allows local attackers to brute-force credentials.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
problemTypes: descriptions: cweId: CWE-307
description: CWE-307: Improper Restriction of Excessive Authentication Attempts
type: CWE
solutions: value: Carrier recommends users upgrade to Version 4000-12 or later, which is the latest supported version at the time of this publication.  Please contact the Hills distributor to acquire the firmware update.
More information on this issue can be found in Carrier product security advisory number CARR-PSA-002-1121.
source: discovery: EXTERNAL
title: Interlogix Hills ComNav  Improper Restriction of Excessive Authentication Attempts
x_generator: engine: Vulnogram 0.0.9