CVE-2022-4636 - OpenCVE

Black Box KVM Firmware version 3.4.31307 on models ACR1000A-R-R2, ACR1000A-T-R2, ACR1002A-T, ACR1002A-R, and ACR1020A-T is vulnerable to path traversal, which may allow an attacker to steal user credentials and other sensitive information through local file inclusion.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Blackbox	Acr1000a-r-r2 Acr1000a-r-r2 Firmware Acr1000a-t-r2 Acr1000a-t-r2 Firmware Acr1002a-r Acr1002a-r Firmware Acr1002a-t Acr1002a-t Firmware Acr1020a-t Acr1020a-t Firmware

Configuration 1 [-]

AND

cpe:2.3:o:blackbox:acr1000a-r-r2_firmware:3.4.31307:*:*:*:*:*:*:*

cpe:2.3:h:blackbox:acr1000a-r-r2:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:blackbox:acr1000a-t-r2_firmware:3.4.31307:*:*:*:*:*:*:*

cpe:2.3:h:blackbox:acr1000a-t-r2:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:blackbox:acr1002a-r_firmware:3.4.31307:*:*:*:*:*:*:*

cpe:2.3:h:blackbox:acr1002a-r:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND

cpe:2.3:o:blackbox:acr1002a-t_firmware:3.4.31307:*:*:*:*:*:*:*

cpe:2.3:h:blackbox:acr1002a-t:-:*:*:*:*:*:*:*

Configuration 5 [-]

AND

cpe:2.3:o:blackbox:acr1020a-t_firmware:3.4.31307:*:*:*:*:*:*:*

cpe:2.3:h:blackbox:acr1020a-t:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://www.cisa.gov/uscert/ics/advisories/icsa-23-010-01

History

No history.

MITRE

Status: PUBLISHED

Assigner: icscert

Published: 2023-01-10T19:54:23.077Z

Updated: 2024-08-03T01:48:39.612Z

Reserved: 2022-12-21T20:28:18.237Z

Link: CVE-2022-4636

Vulnrichment

No data.

NVD

Status : Modified

Published: 2023-01-10T20:15:10.607

Modified: 2023-11-07T03:58:25.497

Link: CVE-2022-4636

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2022-4636", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "state": "PUBLISHED", "assignerShortName": "icscert", "dateReserved": "2022-12-21T20:28:18.237Z", "datePublished": "2023-01-10T19:54:23.077Z", "dateUpdated": "2024-08-03T01:48:39.612Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "KVM ACR1020A-T", "vendor": "Black Box", "versions": [{"status": "affected", "version": "3.4.31307"}]}, {"defaultStatus": "unaffected", "product": "KVM ACR1002A-R", "vendor": "Black Box", "versions": [{"status": "affected", "version": "3.4.31307"}]}, {"defaultStatus": "unaffected", "product": "KVM ACR1002A-T", "vendor": "Black Box", "versions": [{"status": "affected", "version": "3.4.31307"}]}, {"defaultStatus": "unaffected", "product": "KVM ACR1000A-T-R2", "vendor": "Black Box", "versions": [{"status": "affected", "version": "3.4.31307"}]}, {"defaultStatus": "unaffected", "product": "KVM ACR1000A-R-R2", "vendor": "Black Box", "versions": [{"status": "affected", "version": "3.4.31307"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Ferhat \u00c7il"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Black Box KVM Firmware version 3.4.31307 on models ACR1000A-R-R2, ACR1000A-T-R2, ACR1002A-T, ACR1002A-R, and ACR1020A-T is vulnerable to path traversal, which may allow an attacker to steal user credentials and other sensitive information through local file inclusion.</p>"}], "value": "Black Box KVM Firmware version 3.4.31307 on models ACR1000A-R-R2, ACR1000A-T-R2, ACR1002A-T, ACR1002A-R, and ACR1020A-T is vulnerable to path traversal, which may allow an attacker to steal user credentials and other sensitive information through local file inclusion.\n\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2023-01-10T19:54:23.077Z"}, "references": [{"tags": ["government-resource"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-23-010-01"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "VINCE 2.0.5", "env": "prod", "origin": "https://cveawg.mitre.org/api//cve/CVE-2022-4636"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T01:48:39.612Z"}, "title": "CVE Program Container", "references": [{"tags": ["government-resource", "x_transferred"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-23-010-01"}]}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:blackbox:acr1000a-r-r2_firmware:3.4.31307:*:*:*:*:*:*:*", "matchCriteriaId": "64D27D88-2CDC-4EAC-9A39-49F98C560797", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:blackbox:acr1000a-r-r2:-:*:*:*:*:*:*:*", "matchCriteriaId": "6FBCC884-104B-47F4-B08A-72AA0A25E898", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:blackbox:acr1000a-t-r2_firmware:3.4.31307:*:*:*:*:*:*:*", "matchCriteriaId": "A8435BA5-8175-4651-8949-37F5DA16F534", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:blackbox:acr1000a-t-r2:-:*:*:*:*:*:*:*", "matchCriteriaId": "94A9F274-7071-42E0-ABC7-FA2F9595B043", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:blackbox:acr1002a-r_firmware:3.4.31307:*:*:*:*:*:*:*", "matchCriteriaId": "A20579B5-23B4-4AA6-8E7C-9A3402994BA0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:blackbox:acr1002a-r:-:*:*:*:*:*:*:*", "matchCriteriaId": "60C8325E-05DF-497C-8396-5838530C6807", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:blackbox:acr1002a-t_firmware:3.4.31307:*:*:*:*:*:*:*", "matchCriteriaId": "00C283C2-B1DB-4EED-B9D5-9FA3E57F14D2", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:blackbox:acr1002a-t:-:*:*:*:*:*:*:*", "matchCriteriaId": "B7F68C48-1D3E-4071-8C42-E4816D43A1A6", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:blackbox:acr1020a-t_firmware:3.4.31307:*:*:*:*:*:*:*", "matchCriteriaId": "05618BE3-FBAB-422A-86BF-78F1FB71032F", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:blackbox:acr1020a-t:-:*:*:*:*:*:*:*", "matchCriteriaId": "955FBC9D-2B5B-4333-9B34-41D19036BD64", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Black Box KVM Firmware version 3.4.31307 on models ACR1000A-R-R2, ACR1000A-T-R2, ACR1002A-T, ACR1002A-R, and ACR1020A-T is vulnerable to path traversal, which may allow an attacker to steal user credentials and other sensitive information through local file inclusion.\n\n"}, {"lang": "es", "value": "La versi\u00f3n 3.4.31307 de Black Box KVM Firmware en los modelos ACR1000A-R-R2, ACR1000A-T-R2, ACR1002A-T, ACR1002A-R y ACR1020A-T es vulnerable a path traversal, lo que puede permitir a un atacante robar credenciales de usuario y otra informaci\u00f3n confidencial mediante la inclusi\u00f3n de archivos locales."}], "id": "CVE-2022-4636", "lastModified": "2023-11-07T03:58:25.497", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}, "published": "2023-01-10T20:15:10.607", "references": [{"source": "ics-cert@hq.dhs.gov", "tags": ["Patch", "Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-23-010-01"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "ics-cert@hq.dhs.gov", "type": "Primary"}]}