CVE-2022-2790
Assigner: icscert
Published: 2022-08-19T22:32:03
State: PUBLISHED
affected: product: Proficy Machine Edition
vendor: Emerson Electric
versions: lessThanOrEqual: 9.00
status: affected
version: all
versionType: custom
credits: value: Sharon Brizinov of Claroty reported this vulnerability to Emerson and CISA
descriptions: value: Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulenrable to CWE-347 Improper Verification of Cryptographic Signature, and does not properly verify compiled logic (PDT files) and data blocks data (BLD/BLK files).
metrics: cvssV3_1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
version: 3.1
problemTypes: descriptions: cweId: CWE-347
description: CWE-347 Improper Verification of Cryptographic Signature
type: CWE
source: discovery: UNKNOWN
x_generator: engine: Vulnogram 0.0.9