IM
IronMonkey Threat Research

CVE-2022-43377 HIGH

Published: 2023-04-18 | Last Modified: 2024-11-21 | Status: Modified

Description

A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could cause account takeover when a brute force attack is performed on the account. Affected Products: NetBotz 4 - 355/450/455/550/570 (V4.7.0 and prior)

CVSS Metrics

Base Score: 7.5 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactHIGH
Integrity ImpactNONE
Availability ImpactNONE

Source: [email protected]

Type: Primary

Exploitability Score: 3.9

Impact Score: 3.6

Weaknesses

Source Type Description
[email protected] Secondary
en CWE-307

Affected Products

Vendor Product Version Update Type
schneider-electric netbotz_355_firmware * <built-in method update of dict object at 0x7e6110a54d00> Operating System
schneider-electric netbotz_450_firmware * <built-in method update of dict object at 0x7e6110a55dc0> Operating System
schneider-electric netbotz_455_firmware * <built-in method update of dict object at 0x7e6110a57e00> Operating System
schneider-electric netbotz_550_firmware * <built-in method update of dict object at 0x7e6110a56a40> Operating System
schneider-electric netbotz_570_firmware * <built-in method update of dict object at 0x7e6110a552c0> Operating System

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:netbotz_355_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:netbotz_355:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:netbotz_450_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:netbotz_450:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:netbotz_455_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:netbotz_455:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:netbotz_550_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:netbotz_550:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:netbotz_570_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:netbotz_570:-:*:*:*:*:*:*:*

References

Notification
Message here