CVE-2022-3079 - OpenCVE

Festo control block CPX-CEC-C1 and CPX-CMXX in multiple versions allow unauthenticated, remote access to critical webpage functions which may cause a denial of service.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Festo	Cpx-cec-c1 Cpx-cec-c1 Firmware Cpx-cmxx Cpx-cmxx Firmware

Configuration 1 [-]

AND

cpe:2.3:o:festo:cpx-cmxx_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:festo:cpx-cmxx:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:festo:cpx-cec-c1_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:festo:cpx-cec-c1:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://cert.vde.com/en/advisories/VDE-2022-036

History

No history.

MITRE

Status: PUBLISHED

Assigner: CERTVDE

Published: 2022-09-20T10:10:17

Updated: 2024-08-03T01:00:10.805Z

Reserved: 2022-09-01T00:00:00

Link: CVE-2022-3079

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2022-09-20T10:15:10.587

Modified: 2022-09-21T18:06:49.770

Link: CVE-2022-3079

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "Control block CPX-CEC-C1 (no. 567347)", "vendor": "FESTO", "versions": [{"lessThanOrEqual": "2.0.12", "status": "affected", "version": "0.0.1", "versionType": "custom"}]}, {"product": "Control block CPX-CMXX (no. 555667)", "vendor": "FESTO", "versions": [{"lessThanOrEqual": "1.2.34 rev.269404", "status": "affected", "version": "0.0.1", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "Daniel dos Santos and Rob Hulsebos from Forescout reported to Festo"}], "descriptions": [{"lang": "en", "value": "Festo control block CPX-CEC-C1 and CPX-CMXX in multiple versions allow unauthenticated, remote access to critical webpage functions which may cause a denial of service."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-269", "description": "CWE-269 Improper Privilege Management", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-09-20T10:10:17", "orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "shortName": "CERTVDE"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://cert.vde.com/en/advisories/VDE-2022-036"}], "source": {"advisory": "VDE-2022-036", "defect": ["CERT@VDE#64174"], "discovery": "EXTERNAL"}, "title": "Festo: CPX-CEC-C1 and CMXX, Missing Authentication for Critical Webpage Function", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "info@cert.vde.com", "ID": "CVE-2022-3079", "STATE": "PUBLIC", "TITLE": "Festo: CPX-CEC-C1 and CMXX, Missing Authentication for Critical Webpage Function"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Control block CPX-CEC-C1 (no. 567347)", "version": {"version_data": [{"version_affected": "<=", "version_name": "0.0.1", "version_value": "2.0.12"}]}}, {"product_name": "Control block CPX-CMXX (no. 555667)", "version": {"version_data": [{"version_affected": "<=", "version_name": "0.0.1", "version_value": "1.2.34 rev.269404"}]}}]}, "vendor_name": "FESTO"}]}}, "credit": [{"lang": "eng", "value": "Daniel dos Santos and Rob Hulsebos from Forescout reported to Festo"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Festo control block CPX-CEC-C1 and CPX-CMXX in multiple versions allow unauthenticated, remote access to critical webpage functions which may cause a denial of service."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-269 Improper Privilege Management"}]}]}, "references": {"reference_data": [{"name": "https://cert.vde.com/en/advisories/VDE-2022-036", "refsource": "CONFIRM", "url": "https://cert.vde.com/en/advisories/VDE-2022-036"}]}, "source": {"advisory": "VDE-2022-036", "defect": ["CERT@VDE#64174"], "discovery": "EXTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T01:00:10.805Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://cert.vde.com/en/advisories/VDE-2022-036"}]}]}, "cveMetadata": {"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "assignerShortName": "CERTVDE", "cveId": "CVE-2022-3079", "datePublished": "2022-09-20T10:10:17", "dateReserved": "2022-09-01T00:00:00", "dateUpdated": "2024-08-03T01:00:10.805Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:festo:cpx-cmxx_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "2A734858-6728-452C-BEF4-9C638380180D", "versionEndIncluding": "2.0.12", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:festo:cpx-cmxx:-:*:*:*:*:*:*:*", "matchCriteriaId": "467CCB2B-2FCC-4885-9CD3-52F312FD20B8", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:festo:cpx-cec-c1_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "F1F679EE-D2D0-496D-AB98-70E99F285358", "versionEndIncluding": "1.2.34", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:festo:cpx-cec-c1:-:*:*:*:*:*:*:*", "matchCriteriaId": "58B42CEE-8A72-4C1D-9951-7E147282718A", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Festo control block CPX-CEC-C1 and CPX-CMXX in multiple versions allow unauthenticated, remote access to critical webpage functions which may cause a denial of service."}, {"lang": "es", "value": "El bloque de control de Festo CPX-CEC-C1 y CPX-CMXX en varias versiones, permite el acceso remoto no autenticado a funciones cr\u00edticas de la p\u00e1gina web que pueden causar una denegaci\u00f3n de servicio"}], "id": "CVE-2022-3079", "lastModified": "2022-09-21T18:06:49.770", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "info@cert.vde.com", "type": "Primary"}]}, "published": "2022-09-20T10:15:10.587", "references": [{"source": "info@cert.vde.com", "tags": ["Mitigation", "Third Party Advisory"], "url": "https://cert.vde.com/en/advisories/VDE-2022-036"}], "sourceIdentifier": "info@cert.vde.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-269"}], "source": "info@cert.vde.com", "type": "Primary"}]}