CVE-2022-1743 - OpenCVE

The tested version of Dominion Voting System ImageCast X can be manipulated to cause arbitrary code execution by specially crafted election definition files. An attacker could leverage this vulnerability to spread malicious code to ImageCast X devices from the EMS.

Attack Vector Physical

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Local

Access Complexity Low

Authentication None

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

AV:L/AC:L/Au:N/C:C/I:C/A:C

Vendors & Products
CPE Configurations

Vendors	Products
Dominionvoting	Democracy Suite Imagecast X

Configuration 1 [-]

AND

cpe:2.3:o:dominionvoting:imagecast_x:*:*:*:*:*:*:*:*

cpe:2.3:h:dominionvoting:democracy_suite:5.5-a:*:*:*:*:*:*:*

Configuration 2 [-]

AND

OR	cpe:2.3:a:dominionvoting:imagecast_x:5.5.10.30:::::::*
	cpe:2.3:a:dominionvoting:imagecast_x:5.5.10.32:::::::*

cpe:2.3:h:dominionvoting:democracy_suite:5.5-a:*:*:*:*:*:*:*

References

Link	Resource
https://www.cisa.gov/uscert/ics/advisories/icsa-22-154-01	Mitigation Third Party Advisory US Government Resource

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: icscert

Published: 2022-06-03T00:00:00

Updated: 2022-06-24T15:00:25

Reserved: 2022-05-16T00:00:00

Link: CVE-2022-1743

JSON object: View

NVD Information

Status : Analyzed

Published: 2022-06-24T15:15:09.890

Modified: 2022-07-06T02:04:07.497

Link: CVE-2022-1743

JSON object: View

Redhat Information

No data.

CWE

CWE-24

{"containers": {"cna": {"affected": [{"product": "ImageCast X application", "vendor": "Dominion Voting System", "versions": [{"status": "affected", "version": "Version 5.5-A Versions 5.5.10.30 and 5.5.10.32"}]}, {"product": "ImageCast X firmware", "vendor": "Dominion Voting System", "versions": [{"status": "affected", "version": "Version 5.5-A"}]}], "datePublic": "2022-06-03T00:00:00", "descriptions": [{"lang": "en", "value": "The tested version of Dominion Voting System ImageCast X can be manipulated to cause arbitrary code execution by specially crafted election definition files. An attacker could leverage this vulnerability to spread malicious code to ImageCast X devices from the EMS."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-24", "description": "CWE-24", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-06-24T15:00:25", "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-154-01"}], "source": {"discovery": "UNKNOWN"}, "title": "2.2.5 PATH TRAVERSAL: '../FILEDIR' CWE-24", "x_legacyV4Record": {"CVE_data_meta": {"AKA": "", "ASSIGNER": "ics-cert@hq.dhs.gov", "DATE_PUBLIC": "20220603T06:00:00.000000Z", "ID": "CVE-2022-1743", "STATE": "PUBLIC", "TITLE": "2.2.5 PATH TRAVERSAL: '../FILEDIR' CWE-24"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "ImageCast X application", "version": {"version_data": [{"platform": "", "version_affected": "=", "version_name": "Version 5.5-A", "version_value": "Versions 5.5.10.30 and 5.5.10.32"}]}}]}, "vendor_name": "Dominion Voting System"}, {"product": {"product_data": [{"product_name": "ImageCast X firmware", "version": {"version_data": [{"platform": "", "version_affected": "=", "version_name": "", "version_value": "Version 5.5-A"}]}}]}, "vendor_name": "Dominion Voting System"}]}}, "credit": [], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The tested version of Dominion Voting System ImageCast X can be manipulated to cause arbitrary code execution by specially crafted election definition files. An attacker could leverage this vulnerability to spread malicious code to ImageCast X devices from the EMS."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-24"}]}]}, "references": {"reference_data": [{"name": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-154-01", "refsource": "MISC", "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-154-01"}]}, "solution": [], "source": {"advisory": "", "defect": [], "discovery": "UNKNOWN"}, "work_around": []}}}, "cveMetadata": {"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "assignerShortName": "icscert", "cveId": "CVE-2022-1743", "datePublished": "2022-06-03T00:00:00", "dateReserved": "2022-05-16T00:00:00", "dateUpdated": "2022-06-24T15:00:25", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dominionvoting:imagecast_x:*:*:*:*:*:*:*:*", "matchCriteriaId": "36AF91D2-BA55-4090-8629-C962EF5C7D68", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dominionvoting:democracy_suite:5.5-a:*:*:*:*:*:*:*", "matchCriteriaId": "7EF6FA8A-7FEE-473C-BB74-D5DC7A9FE24A", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:dominionvoting:imagecast_x:5.5.10.30:*:*:*:*:*:*:*", "matchCriteriaId": "8207CE21-4D63-492C-973C-E9045EAB1082", "vulnerable": true}, {"criteria": "cpe:2.3:a:dominionvoting:imagecast_x:5.5.10.32:*:*:*:*:*:*:*", "matchCriteriaId": "4D398E91-1F02-46E7-B87B-8FA0821F63BC", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dominionvoting:democracy_suite:5.5-a:*:*:*:*:*:*:*", "matchCriteriaId": "7EF6FA8A-7FEE-473C-BB74-D5DC7A9FE24A", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "The tested version of Dominion Voting System ImageCast X can be manipulated to cause arbitrary code execution by specially crafted election definition files. An attacker could leverage this vulnerability to spread malicious code to ImageCast X devices from the EMS."}, {"lang": "es", "value": "La versi\u00f3n probada de Dominion Voting System ImageCast X puede ser manipulada para causar la ejecuci\u00f3n de c\u00f3digo arbitrario mediante archivos de definici\u00f3n electoral especialmente dise\u00f1ados. Un atacante podr\u00eda aprovechar esta vulnerabilidad para propagar c\u00f3digo malicioso a los dispositivos ImageCast X desde el EMS"}], "id": "CVE-2022-1743", "lastModified": "2022-07-06T02:04:07.497", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "HIGH", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-06-24T15:15:09.890", "references": [{"source": "ics-cert@hq.dhs.gov", "tags": ["Mitigation", "Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-154-01"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-24"}], "source": "ics-cert@hq.dhs.gov", "type": "Primary"}]}