CVE-2022-3228 - OpenCVE

Using custom code, an attacker can write into name or description fields larger than the appropriate buffer size causing a stack-based buffer overflow on Host Engineering H0-ECOM100 Communications Module Firmware versions v5.0.155 and prior. This may allow an attacker to crash the affected device or cause it to become unresponsive.

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Hosteng	H0-ecom100 H0-ecom100 Firmware

Configuration 1 [-]

AND

cpe:2.3:h:hosteng:h0-ecom100:-:*:*:*:*:*:*:*

cpe:2.3:o:hosteng:h0-ecom100_firmware:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://www.cisa.gov/uscert/ics/advisories/icsa-22-263-04

History

No history.

MITRE

Status: PUBLISHED

Assigner: icscert

Published: 2022-10-28T17:17:46.811087Z

Updated: 2024-09-16T17:15:20.303Z

Reserved: 2022-09-15T00:00:00

Link: CVE-2022-3228

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2022-10-28T18:15:12.077

Modified: 2022-11-01T20:35:21.137

Link: CVE-2022-3228

Redhat

No data.

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:h:hosteng:h0-ecom100:-:*:*:*:*:*:*:*", "matchCriteriaId": "CEDEBE22-73C0-4F46-BA93-28D3677E4DA4", "vulnerable": false}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:hosteng:h0-ecom100_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "C5293838-57AE-458F-92A9-C0EC65F98C53", "versionEndExcluding": "5.0.156", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Using custom code, an attacker can write into name or description fields larger than the appropriate buffer size causing a stack-based buffer overflow on Host Engineering H0-ECOM100 Communications Module Firmware versions v5.0.155 and prior. This may allow an attacker to crash the affected device or cause it to become unresponsive."}, {"lang": "es", "value": "Usando c\u00f3digo personalizado, un atacante puede escribir en campos de nombre o descripci\u00f3n m\u00e1s grandes que el tama\u00f1o de b\u00fafer apropiado, lo que provoca un Desbordamiento del B\u00fafer en Host Engineering H0-ECOM100 Communications Module Firmware en las versiones v5.0.155 y anteriores. Esto puede permitir que un atacante bloquee el dispositivo afectado o que deje de responder."}], "id": "CVE-2022-3228", "lastModified": "2022-11-01T20:35:21.137", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}, "published": "2022-10-28T18:15:12.077", "references": [{"source": "ics-cert@hq.dhs.gov", "tags": ["Mitigation", "Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-263-04"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-121"}], "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}