CVE-2022-30627

This vulnerability affects all of the company's products that also include the FW versions: update_i90_cv2.021_b20210104, update_i50_v1.0.55_b20200509, update_x6_v2.1.2_b202001127, update_b5_v2.0.9_b20200706. This vulnerability makes it possible to extract from the FW the existing user passwords on their operating systems and passwords.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.gov.il/en/Departments/faq/cve_advisories	Third Party Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:o:chcnav:p5e_gnss_firmware:4.1:::::::*
	cpe:2.3:o:chcnav:p5e_gnss_firmware:4.2:::::::*
	cpe:2.3:o:chcnav:p5e_gnss_firmware:update_b5_v2.0.9_b20200706:::::::*
	cpe:2.3:o:chcnav:p5e_gnss_firmware:update_i50_v1.0.55_b20200509:::::::*
	cpe:2.3:o:chcnav:p5e_gnss_firmware:update_i90_cv2.021_b20210104:::::::*
	cpe:2.3:o:chcnav:p5e_gnss_firmware:update_x6_v2.1.2_b202001127:::::::*

cpe:2.3:h:chcnav:p5e_gnss:-:*:*:*:*:*:*:*

History

23 Jul 2022, 02:18

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.5
CPE		cpe:2.3:o:chcnav:p5e_gnss_firmware:4.1:::::::* cpe:2.3:o:chcnav:p5e_gnss_firmware:4.2:::::::* cpe:2.3:o:chcnav:p5e_gnss_firmware:update_i90_cv2.021_b20210104:::::::* cpe:2.3:o:chcnav:p5e_gnss_firmware:update_x6_v2.1.2_b202001127:::::::* cpe:2.3:h:chcnav:p5e_gnss:-:::::::* cpe:2.3:o:chcnav:p5e_gnss_firmware:update_i50_v1.0.55_b20200509:::::::* cpe:2.3:o:chcnav:p5e_gnss_firmware:update_b5_v2.0.9_b20200706:::::::*
References	~~(MISC) https://www.gov.il/en/Departments/faq/cve_advisories -~~	(MISC) https://www.gov.il/en/Departments/faq/cve_advisories - Third Party Advisory
CWE		CWE-798

18 Jul 2022, 13:25

Type	Values Removed	Values Added
New CVE

Information

Published : 2022-07-18 13:15

Updated : 2024-02-04 22:51

NVD link : CVE-2022-30627

Mitre link : CVE-2022-30627

CVE.ORG link : CVE-2022-30627

JSON object : View

Products Affected

chcnav

p5e_gnss_firmware
p5e_gnss

CWE

CWE-798

Use of Hard-coded Credentials

{"id": "CVE-2022-30627", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "cna@cyber.gov.il", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.7, "exploitabilityScore": 1.5}]}, "published": "2022-07-18T13:15:10.313", "references": [{"url": "https://www.gov.il/en/Departments/faq/cve_advisories", "tags": ["Third Party Advisory"], "source": "cna@cyber.gov.il"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-798"}]}], "descriptions": [{"lang": "en", "value": "This vulnerability affects all of the company's products that also include the FW versions: update_i90_cv2.021_b20210104, update_i50_v1.0.55_b20200509, update_x6_v2.1.2_b202001127, update_b5_v2.0.9_b20200706. This vulnerability makes it possible to extract from the FW the existing user passwords on their operating systems and passwords."}, {"lang": "es", "value": "Esta vulnerabilidad afecta a todos los productos de la empresa que tambi\u00e9n incluyen las versiones FW: update_i90_cv2.021_b20210104, update_i50_v1.0.55_b20200509, update_x6_v2.1.2_b202001127, update_b5_v2.0.9_b20200706. Esta vulnerabilidad permite extraer del FW las contrase\u00f1as de usuarios existentes en sus sistemas operativos y contrase\u00f1as"}], "lastModified": "2022-07-23T02:18:11.180", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:chcnav:p5e_gnss_firmware:4.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "64FE8B40-946C-4D67-A3BF-BEDB5E3C3502"}, {"criteria": "cpe:2.3:o:chcnav:p5e_gnss_firmware:4.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B26293DB-77D5-4417-B72C-6EEDFE6151D5"}, {"criteria": "cpe:2.3:o:chcnav:p5e_gnss_firmware:update_b5_v2.0.9_b20200706:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9B6BF8F6-DB1A-45BF-9F35-4E15604F3DB2"}, {"criteria": "cpe:2.3:o:chcnav:p5e_gnss_firmware:update_i50_v1.0.55_b20200509:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7EDEAC24-EC1C-4164-8C2A-BFFD97912806"}, {"criteria": "cpe:2.3:o:chcnav:p5e_gnss_firmware:update_i90_cv2.021_b20210104:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D8B2FEC7-451D-456D-B097-8D524DD31D77"}, {"criteria": "cpe:2.3:o:chcnav:p5e_gnss_firmware:update_x6_v2.1.2_b202001127:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DE26452E-8410-419A-A9F7-C6942361B434"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:chcnav:p5e_gnss:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "56783F0F-85AA-4B6F-BC24-3F7659A86567"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cna@cyber.gov.il"}