CVE-2022-3079 - OpenCVE

Festo control block CPX-CEC-C1 and CPX-CMXX in multiple versions allow unauthenticated, remote access to critical webpage functions which may cause a denial of service.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

Vendors & Products
CPE Configurations

Vendors	Products
Festo	Cpx-cec-c1 Firmware Cpx-cmxx Cpx-cec-c1 Cpx-cmxx Firmware

Configuration 1 [-]

AND

cpe:2.3:o:festo:cpx-cmxx_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:festo:cpx-cmxx:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:festo:cpx-cec-c1_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:festo:cpx-cec-c1:-:*:*:*:*:*:*:*

References

Link	Resource
https://cert.vde.com/en/advisories/VDE-2022-036	Mitigation Third Party Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: CERTVDE

Published: 2022-09-20T10:10:17

Updated: 2022-09-20T10:10:17

Reserved: 2022-09-01T00:00:00

Link: CVE-2022-3079

JSON object: View

NVD Information

Status : Analyzed

Published: 2022-09-20T10:15:10.587

Modified: 2022-09-21T18:06:49.770

Link: CVE-2022-3079

JSON object: View

Redhat Information

No data.

CWE

CWE-269

{"containers": {"cna": {"affected": [{"product": "Control block CPX-CEC-C1 (no. 567347)", "vendor": "FESTO", "versions": [{"lessThanOrEqual": "2.0.12", "status": "affected", "version": "0.0.1", "versionType": "custom"}]}, {"product": "Control block CPX-CMXX (no. 555667)", "vendor": "FESTO", "versions": [{"lessThanOrEqual": "1.2.34 rev.269404", "status": "affected", "version": "0.0.1", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "Daniel dos Santos and Rob Hulsebos from Forescout reported to Festo"}], "descriptions": [{"lang": "en", "value": "Festo control block CPX-CEC-C1 and CPX-CMXX in multiple versions allow unauthenticated, remote access to critical webpage functions which may cause a denial of service."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-269", "description": "CWE-269 Improper Privilege Management", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-09-20T10:10:17", "orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "shortName": "CERTVDE"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://cert.vde.com/en/advisories/VDE-2022-036"}], "source": {"advisory": "VDE-2022-036", "defect": ["CERT@VDE#64174"], "discovery": "EXTERNAL"}, "title": "Festo: CPX-CEC-C1 and CMXX, Missing Authentication for Critical Webpage Function", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "info@cert.vde.com", "ID": "CVE-2022-3079", "STATE": "PUBLIC", "TITLE": "Festo: CPX-CEC-C1 and CMXX, Missing Authentication for Critical Webpage Function"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Control block CPX-CEC-C1 (no. 567347)", "version": {"version_data": [{"version_affected": "<=", "version_name": "0.0.1", "version_value": "2.0.12"}]}}, {"product_name": "Control block CPX-CMXX (no. 555667)", "version": {"version_data": [{"version_affected": "<=", "version_name": "0.0.1", "version_value": "1.2.34 rev.269404"}]}}]}, "vendor_name": "FESTO"}]}}, "credit": [{"lang": "eng", "value": "Daniel dos Santos and Rob Hulsebos from Forescout reported to Festo"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Festo control block CPX-CEC-C1 and CPX-CMXX in multiple versions allow unauthenticated, remote access to critical webpage functions which may cause a denial of service."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-269 Improper Privilege Management"}]}]}, "references": {"reference_data": [{"name": "https://cert.vde.com/en/advisories/VDE-2022-036", "refsource": "CONFIRM", "url": "https://cert.vde.com/en/advisories/VDE-2022-036"}]}, "source": {"advisory": "VDE-2022-036", "defect": ["CERT@VDE#64174"], "discovery": "EXTERNAL"}}}}, "cveMetadata": {"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "assignerShortName": "CERTVDE", "cveId": "CVE-2022-3079", "datePublished": "2022-09-20T10:10:17", "dateReserved": "2022-09-01T00:00:00", "dateUpdated": "2022-09-20T10:10:17", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:festo:cpx-cmxx_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "2A734858-6728-452C-BEF4-9C638380180D", "versionEndIncluding": "2.0.12", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:festo:cpx-cmxx:-:*:*:*:*:*:*:*", "matchCriteriaId": "467CCB2B-2FCC-4885-9CD3-52F312FD20B8", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:festo:cpx-cec-c1_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "F1F679EE-D2D0-496D-AB98-70E99F285358", "versionEndIncluding": "1.2.34", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:festo:cpx-cec-c1:-:*:*:*:*:*:*:*", "matchCriteriaId": "58B42CEE-8A72-4C1D-9951-7E147282718A", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "Festo control block CPX-CEC-C1 and CPX-CMXX in multiple versions allow unauthenticated, remote access to critical webpage functions which may cause a denial of service."}, {"lang": "es", "value": "El bloque de control de Festo CPX-CEC-C1 y CPX-CMXX en varias versiones, permite el acceso remoto no autenticado a funciones cr\u00edticas de la p\u00e1gina web que pueden causar una denegaci\u00f3n de servicio"}], "id": "CVE-2022-3079", "lastModified": "2022-09-21T18:06:49.770", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "info@cert.vde.com", "type": "Primary"}]}, "published": "2022-09-20T10:15:10.587", "references": [{"source": "info@cert.vde.com", "tags": ["Mitigation", "Third Party Advisory"], "url": "https://cert.vde.com/en/advisories/VDE-2022-036"}], "sourceIdentifier": "info@cert.vde.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-269"}], "source": "info@cert.vde.com", "type": "Primary"}]}