CVE-2022-4636 - OpenCVE

Black Box KVM Firmware version 3.4.31307 on models ACR1000A-R-R2, ACR1000A-T-R2, ACR1002A-T, ACR1002A-R, and ACR1020A-T is vulnerable to path traversal, which may allow an attacker to steal user credentials and other sensitive information through local file inclusion.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

Vendors & Products
CPE Configurations

Vendors	Products
Blackbox	Acr1000a-t-r2 Firmware Acr1002a-r Acr1000a-t-r2 Acr1002a-r Firmware Acr1000a-r-r2 Firmware Acr1000a-r-r2 Acr1020a-t Firmware Acr1020a-t Acr1002a-t Firmware Acr1002a-t

Configuration 1 [-]

AND

cpe:2.3:o:blackbox:acr1000a-r-r2_firmware:3.4.31307:*:*:*:*:*:*:*

cpe:2.3:h:blackbox:acr1000a-r-r2:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:blackbox:acr1000a-t-r2_firmware:3.4.31307:*:*:*:*:*:*:*

cpe:2.3:h:blackbox:acr1000a-t-r2:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:blackbox:acr1002a-r_firmware:3.4.31307:*:*:*:*:*:*:*

cpe:2.3:h:blackbox:acr1002a-r:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND

cpe:2.3:o:blackbox:acr1002a-t_firmware:3.4.31307:*:*:*:*:*:*:*

cpe:2.3:h:blackbox:acr1002a-t:-:*:*:*:*:*:*:*

Configuration 5 [-]

AND

cpe:2.3:o:blackbox:acr1020a-t_firmware:3.4.31307:*:*:*:*:*:*:*

cpe:2.3:h:blackbox:acr1020a-t:-:*:*:*:*:*:*:*

References

Link	Resource
https://www.cisa.gov/uscert/ics/advisories/icsa-23-010-01	Patch Third Party Advisory US Government Resource

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: icscert

Published: 2023-01-10T19:54:23.077Z

Updated:

Reserved: 2022-12-21T20:28:18.237Z

Link: CVE-2022-4636

JSON object: View

NVD Information

Status : Modified

Published: 2023-01-10T20:15:10.607

Modified: 2023-11-07T03:58:25.497

Link: CVE-2022-4636

JSON object: View

Redhat Information

No data.

CWE

CWE-22

{"dataType": "CVE_RECORD", "dataVersion": "5.0", "cveMetadata": {"cveId": "CVE-2022-4636", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "state": "PUBLISHED", "assignerShortName": "icscert", "dateReserved": "2022-12-21T20:28:18.237Z", "datePublished": "2023-01-10T19:54:23.077Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "KVM ACR1020A-T", "vendor": "Black Box", "versions": [{"status": "affected", "version": "3.4.31307"}]}, {"defaultStatus": "unaffected", "product": "KVM ACR1002A-R", "vendor": "Black Box", "versions": [{"status": "affected", "version": "3.4.31307"}]}, {"defaultStatus": "unaffected", "product": "KVM ACR1002A-T", "vendor": "Black Box", "versions": [{"status": "affected", "version": "3.4.31307"}]}, {"defaultStatus": "unaffected", "product": "KVM ACR1000A-T-R2", "vendor": "Black Box", "versions": [{"status": "affected", "version": "3.4.31307"}]}, {"defaultStatus": "unaffected", "product": "KVM ACR1000A-R-R2", "vendor": "Black Box", "versions": [{"status": "affected", "version": "3.4.31307"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Ferhat \u00c7il"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Black Box KVM Firmware version 3.4.31307 on models ACR1000A-R-R2, ACR1000A-T-R2, ACR1002A-T, ACR1002A-R, and ACR1020A-T is vulnerable to path traversal, which may allow an attacker to steal user credentials and other sensitive information through local file inclusion.</p>"}], "value": "Black Box KVM Firmware version 3.4.31307 on models ACR1000A-R-R2, ACR1000A-T-R2, ACR1002A-T, ACR1002A-R, and ACR1020A-T is vulnerable to path traversal, which may allow an attacker to steal user credentials and other sensitive information through local file inclusion.\n\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2023-01-10T19:54:23.077Z"}, "references": [{"tags": ["government-resource"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-23-010-01"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "VINCE 2.0.5", "env": "prod", "origin": "https://cveawg.mitre.org/api//cve/CVE-2022-4636"}}}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:blackbox:acr1000a-r-r2_firmware:3.4.31307:*:*:*:*:*:*:*", "matchCriteriaId": "64D27D88-2CDC-4EAC-9A39-49F98C560797", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:blackbox:acr1000a-r-r2:-:*:*:*:*:*:*:*", "matchCriteriaId": "6FBCC884-104B-47F4-B08A-72AA0A25E898", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:blackbox:acr1000a-t-r2_firmware:3.4.31307:*:*:*:*:*:*:*", "matchCriteriaId": "A8435BA5-8175-4651-8949-37F5DA16F534", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:blackbox:acr1000a-t-r2:-:*:*:*:*:*:*:*", "matchCriteriaId": "94A9F274-7071-42E0-ABC7-FA2F9595B043", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:blackbox:acr1002a-r_firmware:3.4.31307:*:*:*:*:*:*:*", "matchCriteriaId": "A20579B5-23B4-4AA6-8E7C-9A3402994BA0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:blackbox:acr1002a-r:-:*:*:*:*:*:*:*", "matchCriteriaId": "60C8325E-05DF-497C-8396-5838530C6807", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:blackbox:acr1002a-t_firmware:3.4.31307:*:*:*:*:*:*:*", "matchCriteriaId": "00C283C2-B1DB-4EED-B9D5-9FA3E57F14D2", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:blackbox:acr1002a-t:-:*:*:*:*:*:*:*", "matchCriteriaId": "B7F68C48-1D3E-4071-8C42-E4816D43A1A6", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:blackbox:acr1020a-t_firmware:3.4.31307:*:*:*:*:*:*:*", "matchCriteriaId": "05618BE3-FBAB-422A-86BF-78F1FB71032F", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:blackbox:acr1020a-t:-:*:*:*:*:*:*:*", "matchCriteriaId": "955FBC9D-2B5B-4333-9B34-41D19036BD64", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "Black Box KVM Firmware version 3.4.31307 on models ACR1000A-R-R2, ACR1000A-T-R2, ACR1002A-T, ACR1002A-R, and ACR1020A-T is vulnerable to path traversal, which may allow an attacker to steal user credentials and other sensitive information through local file inclusion.\n\n"}, {"lang": "es", "value": "La versi\u00f3n 3.4.31307 de Black Box KVM Firmware en los modelos ACR1000A-R-R2, ACR1000A-T-R2, ACR1002A-T, ACR1002A-R y ACR1020A-T es vulnerable a path traversal, lo que puede permitir a un atacante robar credenciales de usuario y otra informaci\u00f3n confidencial mediante la inclusi\u00f3n de archivos locales."}], "id": "CVE-2022-4636", "lastModified": "2023-11-07T03:58:25.497", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}, "published": "2023-01-10T20:15:10.607", "references": [{"source": "ics-cert@hq.dhs.gov", "tags": ["Patch", "Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-23-010-01"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "ics-cert@hq.dhs.gov", "type": "Primary"}]}