IM
IronMonkey Threat Research

CVE-2022-43378 MEDIUM

Published: 2023-04-18 | Last Modified: 2024-11-21 | Status: Modified

Description

A CWE-1021: Improper Restriction of Rendered UI Layers or Frames vulnerability exists that could cause the user to be tricked into performing unintended actions when external address frames are not properly restricted. Affected Products: NetBotz 4 - 355/450/455/550/570 (V4.7.0 and prior)

CVSS Metrics

Base Score: 6.5 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionREQUIRED
ScopeUNCHANGED
Confidentiality ImpactNONE
Integrity ImpactHIGH
Availability ImpactNONE

Source: [email protected]

Type: Primary

Exploitability Score: 2.8

Impact Score: 3.6

Weaknesses

Source Type Description
[email protected] Secondary
en CWE-1021

Affected Products

Vendor Product Version Update Type
schneider-electric netbotz_355_firmware * <built-in method update of dict object at 0x7e60a88adc40> Operating System
schneider-electric netbotz_450_firmware * <built-in method update of dict object at 0x7e60a88ad100> Operating System
schneider-electric netbotz_455_firmware * <built-in method update of dict object at 0x7e60a88ad140> Operating System
schneider-electric netbotz_550_firmware * <built-in method update of dict object at 0x7e6108404280> Operating System
schneider-electric netbotz_570_firmware * <built-in method update of dict object at 0x7e60a88acf80> Operating System

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:netbotz_355_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:netbotz_355:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:netbotz_450_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:netbotz_450:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:netbotz_455_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:netbotz_455:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:netbotz_550_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:netbotz_550:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:schneider-electric:netbotz_570_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:schneider-electric:netbotz_570:-:*:*:*:*:*:*:*

References

Notification
Message here