CVE-2022-2088
Assigner: icscert
Published: 2022-06-27T16:14:07
State: PUBLISHED
affected: product: SmartICS
vendor: Elcomplus
versions: status: affected
version: v2.3.4.0
credits: value: Michael Heinzl reported these vulnerabilities to CISA.
descriptions: value: An authenticated user with admin privileges may be able to terminate any process on the system running Elcomplus SmartICS v2.3.4.0.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
version: 3.1
problemTypes: descriptions: cweId: CWE-284
description: CWE-284: Improper Access Control
type: CWE
solutions: value: Elcomplus has released Version 2.4 to address these vulnerabilities and recommends users update to the newest version. Users can obtain the new version on request on the official SmartICS website https://smartics.io/
source: discovery: EXTERNAL
title: Elcomplus SmartICS Access Control
x_generator: engine: Vulnogram 0.0.9