IM
IronMonkey Threat Research

CVE-2022-22813 CRITICAL

Published: 2022-02-09 | Last Modified: 2024-11-21 | Status: Modified

Description

A CWE-798: Use of Hard-coded Credentials vulnerability exists. If an attacker were to obtain the TLS cryptographic key and take active control of the Courier tunneling communication network, they could potentially observe and manipulate traffic associated with product configuration.

Additional Descriptions (1)

Una CWE-798: Se presenta una vulnerabilidad de Uso de Credenciales Embebidas. Si un atacante obtuviera la clave criptográfica TLS y tomara el control activo de la red de comunicación de túneles de Courier, podría potencialmente observar y manipular el tráfico asociado a la configuración del producto

CVSS Metrics

Base Score: 9.8 (CRITICAL)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactHIGH
Integrity ImpactHIGH
Availability ImpactHIGH

Source: [email protected]

Type: Primary

Exploitability Score: 3.9

Impact Score: 5.9

Base Score: 7.5 (HIGH)

AV:N/AC:L/Au:N/C:P/I:P/A:P

Access VectorNETWORK
Access ComplexityLOW
AuthenticationNONE
Confidentiality ImpactPARTIAL
Integrity ImpactPARTIAL
Availability ImpactPARTIAL

Source: [email protected]

Type: Primary

Exploitability Score: 10.0

Impact Score: 6.4

Weaknesses

Source Type Description
[email protected] Secondary
en CWE-798

Affected Products

Vendor Product Version Update Type
schneider-electric easergy_p141_firmware - <built-in method update of dict object at 0x7e61109d7680> Operating System
schneider-electric easergy_p142_firmware - <built-in method update of dict object at 0x7e60baface00> Operating System
schneider-electric easergy_p143_firmware - <built-in method update of dict object at 0x7e6100e8ad40> Operating System
schneider-electric easergy_p145_firmware - <built-in method update of dict object at 0x7e61109d41c0> Operating System
schneider-electric easergy_p241_firmware - <built-in method update of dict object at 0x7e61109d7d00> Operating System
schneider-electric easergy_p242_firmware - <built-in method update of dict object at 0x7e61109d42c0> Operating System
schneider-electric easergy_p243_firmware - <built-in method update of dict object at 0x7e60bacd5dc0> Operating System
schneider-electric easergy_p342_firmware - <built-in method update of dict object at 0x7e61109d6280> Operating System
schneider-electric easergy_p343_firmware - <built-in method update of dict object at 0x7e6108405c00> Operating System
schneider-electric easergy_p344_firmware - <built-in method update of dict object at 0x7e61109d6100> Operating System
schneider-electric easergy_p345_firmware - <built-in method update of dict object at 0x7e61109d5d80> Operating System
schneider-electric easergy_p441_firmware - <built-in method update of dict object at 0x7e60bafac740> Operating System
schneider-electric easergy_p442_firmware - <built-in method update of dict object at 0x7e6108407380> Operating System
schneider-electric easergy_p443_firmware - <built-in method update of dict object at 0x7e60bafae300> Operating System
schneider-electric easergy_p444_firmware - <built-in method update of dict object at 0x7e60a8896a00> Operating System
schneider-electric easergy_p445_firmware - <built-in method update of dict object at 0x7e61109d5c00> Operating System
schneider-electric easergy_p446_firmware - <built-in method update of dict object at 0x7e61109d5e80> Operating System
schneider-electric easergy_p541_firmware - <built-in method update of dict object at 0x7e60bafacb80> Operating System
schneider-electric easergy_p542_firmware - <built-in method update of dict object at 0x7e6112397e80> Operating System
schneider-electric easergy_p543_firmware - <built-in method update of dict object at 0x7e613cecd000> Operating System
schneider-electric easergy_p544_firmware - <built-in method update of dict object at 0x7e60bafadcc0> Operating System
schneider-electric easergy_p545_firmware - <built-in method update of dict object at 0x7e60bafae400> Operating System
schneider-electric easergy_p546_firmware - <built-in method update of dict object at 0x7e60a8897640> Operating System
schneider-electric easergy_p642_firmware - <built-in method update of dict object at 0x7e60bafac7c0> Operating System
schneider-electric easergy_p643_firmware - <built-in method update of dict object at 0x7e613c3ce480> Operating System
schneider-electric easergy_p645_firmware - <built-in method update of dict object at 0x7e60bafaf880> Operating System
schneider-electric easergy_p741_firmware - <built-in method update of dict object at 0x7e6112306340> Operating System
schneider-electric easergy_p742_firmware - <built-in method update of dict object at 0x7e60a8895ec0> Operating System
schneider-electric easergy_p743_firmware - <built-in method update of dict object at 0x7e61109d6bc0> Operating System
schneider-electric easergy_p746_firmware - <built-in method update of dict object at 0x7e6111c1c2c0> Operating System
schneider-electric easergy_p341_firmware - <built-in method update of dict object at 0x7e61109d72c0> Operating System
schneider-electric easergy_p841_firmware - <built-in method update of dict object at 0x7e61109d5a80> Operating System
schneider-electric easergy_p849_firmware - <built-in method update of dict object at 0x7e61109d57c0> Operating System

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:easergy_p141_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:easergy_p141:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:easergy_p142_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:easergy_p142:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:easergy_p143_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:easergy_p143:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:easergy_p145_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:easergy_p145:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:easergy_p241_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:easergy_p241:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:easergy_p242_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:easergy_p242:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:easergy_p243_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:easergy_p243:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:easergy_p342_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:easergy_p342:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:easergy_p343_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:easergy_p343:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:easergy_p344_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:easergy_p344:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:easergy_p345_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:easergy_p345:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:easergy_p441_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:easergy_p441:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:easergy_p442_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:easergy_p442:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:easergy_p443_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:easergy_p443:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:easergy_p444_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:easergy_p444:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:easergy_p445_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:easergy_p445:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:easergy_p446_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:easergy_p446:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:easergy_p541_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:easergy_p541:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:easergy_p542_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:easergy_p542:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:easergy_p543_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:easergy_p543:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:easergy_p544_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:easergy_p544:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:easergy_p545_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:easergy_p545:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:easergy_p546_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:easergy_p546:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:easergy_p642_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:easergy_p642:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:easergy_p643_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:easergy_p643:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:easergy_p645_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:easergy_p645:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:easergy_p741_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:easergy_p741:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:easergy_p742_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:easergy_p742:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:easergy_p743_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:easergy_p743:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:easergy_p746_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:easergy_p746:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:easergy_p341_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:easergy_p341:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:easergy_p841_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:easergy_p841:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:easergy_p849_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:easergy_p849:-:*:*:*:*:*:*:*

References

Notification
Message here