CVE-2022-2334

The application searches for a library dll that is not found. If an attacker can place a dll with this name, then the attacker can leverage it to execute arbitrary code on the targeted Softing Secure Integration Server V1.22.

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://industrial.softing.com/fileadmin/psirt/downloads/syt-2022-5.html	Mitigation Vendor Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-22-228-04	Mitigation Third Party Advisory US Government Resource

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:softing:edgeaggregator:3.1:::::::*
	cpe:2.3:a:softing:edgeconnector:3.1:::::::*
	cpe:2.3:a:softing:opc:5.2:::::::*
	cpe:2.3:a:softing:opc_ua_c\+\+_software_development_kit:6:::::::*
	cpe:2.3:a:softing:secure_integration_server:1.22:::::::*
	cpe:2.3:a:softing:uagates:1.74:::::::*

History

19 Aug 2022, 12:52

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.2
References	~~(CONFIRM) https://www.cisa.gov/uscert/ics/advisories/icsa-22-228-04 -~~	(CONFIRM) https://www.cisa.gov/uscert/ics/advisories/icsa-22-228-04 - Mitigation, Third Party Advisory, US Government Resource
References	~~(CONFIRM) https://industrial.softing.com/fileadmin/psirt/downloads/syt-2022-5.html -~~	(CONFIRM) https://industrial.softing.com/fileadmin/psirt/downloads/syt-2022-5.html - Mitigation, Vendor Advisory
CPE		cpe:2.3:a:softing:edgeconnector:3.1:::::::* cpe:2.3:a:softing:secure_integration_server:1.22:::::::* cpe:2.3:a:softing:edgeaggregator:3.1:::::::* cpe:2.3:a:softing:opc:5.2:::::::* cpe:2.3:a:softing:opc_ua_c\+\+_software_development_kit:6:::::::* cpe:2.3:a:softing:uagates:1.74:::::::*

17 Aug 2022, 21:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2022-08-17 21:15

Updated : 2024-02-04 22:51

NVD link : CVE-2022-2334

Mitre link : CVE-2022-2334

CVE.ORG link : CVE-2022-2334

JSON object : View

Products Affected

softing

edgeaggregator
opc_ua_c\+\+_software_development_kit
uagates
edgeconnector
secure_integration_server
opc

CWE

CWE-427

Uncontrolled Search Path Element

{"id": "CVE-2022-2334", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}, {"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "published": "2022-08-17T21:15:08.973", "references": [{"url": "https://industrial.softing.com/fileadmin/psirt/downloads/syt-2022-5.html", "tags": ["Mitigation", "Vendor Advisory"], "source": "ics-cert@hq.dhs.gov"}, {"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-228-04", "tags": ["Mitigation", "Third Party Advisory", "US Government Resource"], "source": "ics-cert@hq.dhs.gov"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-427"}]}], "descriptions": [{"lang": "en", "value": "The application searches for a library dll that is not found. If an attacker can place a dll with this name, then the attacker can leverage it to execute arbitrary code on the targeted Softing Secure Integration Server V1.22."}, {"lang": "es", "value": "La aplicaci\u00f3n busca una biblioteca dll que no es encontrada. Si un atacante puede colocar una dll con este nombre, entonces el atacante puede aprovecharla para ejecutar c\u00f3digo arbitrario en Softing Secure Integration Server versi\u00f3n V1.22 objetivo."}], "lastModified": "2022-08-19T12:52:28.000", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:softing:edgeaggregator:3.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C0E07A55-5FA0-402D-BB22-FA8D3D8C484D"}, {"criteria": "cpe:2.3:a:softing:edgeconnector:3.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "62FE322E-A720-4E08-9058-3BAC295E720B"}, {"criteria": "cpe:2.3:a:softing:opc:5.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A9916828-8213-47D4-B294-8112B241F32C"}, {"criteria": "cpe:2.3:a:softing:opc_ua_c\\+\\+_software_development_kit:6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BA185EBD-8048-4B1C-A476-4AE61831ACF7"}, {"criteria": "cpe:2.3:a:softing:secure_integration_server:1.22:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0BF8EC24-9C94-4C55-A496-5DD524B981C4"}, {"criteria": "cpe:2.3:a:softing:uagates:1.74:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2DD68DEC-1E1C-456F-8FC2-F3EF9A72B012"}], "operator": "OR"}]}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}