CVE-2022-22809 MEDIUM

Published: 2022-02-09 | Last Modified: 2024-11-21 | Status: Modified

Description

A CWE-306: Missing Authentication for Critical Function vulnerability exists that could allow modifications of the touch configurations in an unauthorized manner when an attacker attempts to modify the touch configurations. Affected Product: spaceLYnk (V2.6.2 and prior), Wiser for KNX (formerly homeLYnk) (V2.6.2 and prior), fellerLYnk (V2.6.2 and prior)

Additional Descriptions (1)

Una CWE-306: Se presenta una vulnerabilidad de Falta de Autenticación para la Función Crítica que podría permitir una modificación de las configuraciones táctiles de forma no autorizada cuando un atacante intenta modificar las configuraciones táctiles. Producto afectado: spaceLYnk (versiones V2.6.2 y anteriores), Wiser for KNX (anteriormente homeLYnk) (versiones V2.6.2 y anteriores), fellerLYnk (versiones V2.6.2 y anteriores)

CVSS Metrics

Base Score: 5.3 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector	NETWORK
Attack Complexity	LOW
Privileges Required	NONE
User Interaction	NONE
Scope	UNCHANGED
Confidentiality Impact	NONE
Integrity Impact	LOW
Availability Impact	NONE

Source: [email protected]

Type: Primary

Exploitability Score: 3.9

Impact Score: 1.4

Base Score: 5.0 (MEDIUM)

AV:N/AC:L/Au:N/C:N/I:P/A:N

Access Vector	NETWORK
Access Complexity	LOW
Authentication	NONE
Confidentiality Impact	NONE
Integrity Impact	PARTIAL
Availability Impact	NONE

Source: [email protected]

Type: Primary

Exploitability Score: 10.0

Impact Score: 2.9

Weaknesses

Source	Type	Description
[email protected]	Secondary	en CWE-306
[email protected]	Secondary	en CWE-306

Affected Products

Vendor	Product	Version	Update	Type
schneider-electric	spacelynk_firmware	*	<built-in method update of dict object at 0x7e6110a9f4c0>	Operating System
schneider-electric	wiser_for_knx_firmware	*	<built-in method update of dict object at 0x7e6107e521c0>	Operating System
schneider-electric	fellerlynk_firmware	*	<built-in method update of dict object at 0x7e6107e52300>	Operating System

Affected Configurations

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:spacelynk_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:spacelynk:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:wiser_for_knx_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:wiser_for_knx:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:fellerlynk_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:fellerlynk:-:::::::*`

References

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-039-04
Source: [email protected]

Patch Vendor Advisory
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-039-04
Source: af854a3a-2127-422b-91ae-364da2661108

Patch Vendor Advisory