certfr_avis - certfr-2022-avi-1061

CERTFR-2022-AVI-1061

Vulnerability from certfr_avis - Published: - Updated:

De multiples vulnérabilités ont été découvertes dans Moxa Gamme UC. Elles permettent à un attaquant de provoquer un contournement de la politique de sécurité.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Moxa	N/A	Gamme UC-8200 versions V1.0 à V2.4 sans le dernier correctif de sécurité
Moxa	N/A	Gamme UC-8580 versions V1.1 sans le dernier correctif de sécurité
Moxa	N/A	Gamme UC-5100 versions V1.2 sans le dernier correctif de sécurité
Moxa	N/A	Gamme UC-8540 versions V1.0 à V1.2 sans le dernier correctif de sécurité
Moxa	N/A	Gamme UC-2100 versions V1.3 à V1.5 sans le dernier correctif de sécurité
Moxa	N/A	Gamme UC-3100 versions V1.2 à V2.0 sans le dernier correctif de sécurité
Moxa	N/A	Gamme UC-2100-W versions V1.3 à V1.5 sans le dernier correctif de sécurité
Moxa	N/A	Gamme UC-8100 versions V1.2 à V1.3 sans le dernier correctif de sécurité
Moxa	N/A	Gamme UC-8100A-ME-T versions V1.0 à V1.1 sans le dernier correctif de sécurité
Moxa	N/A	Gamme UC-8410A versions V2.2 sans le dernier correctif de sécurité

References

Title

Publication Time

Tags

Bulletin de sécurité Moxa du 29 novembre 2022

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Gamme UC-8200 versions V1.0 \u00e0 V2.4 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "Gamme UC-8580 versions V1.1 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "Gamme UC-5100 versions V1.2 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "Gamme UC-8540 versions V1.0 \u00e0 V1.2 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "Gamme UC-2100 versions V1.3 \u00e0 V1.5 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "Gamme UC-3100 versions V1.2 \u00e0 V2.0 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "Gamme UC-2100-W versions V1.3 \u00e0 V1.5 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "Gamme UC-8100 versions V1.2 \u00e0 V1.3 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "Gamme UC-8100A-ME-T versions V1.0 \u00e0 V1.1 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "Gamme UC-8410A versions V2.2 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2022-3086",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-3086"
    }
  ],
  "links": [],
  "reference": "CERTFR-2022-AVI-1061",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2022-11-29T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Moxa Gamme UC.\nElles permettent \u00e0 un attaquant de provoquer un contournement de la\npolitique de s\u00e9curit\u00e9.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Moxa Gamme UC",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Moxa du 29 novembre 2022",
      "url": "https://www.moxa.com/en/support/product-support/security-advisory/uc-series-improper-physical-access-control-vulnerability"
    }
  ]
}

CVE-2022-3086 (GCVE-0-2022-3086)

Vulnerability from cvelistv5 – Published: 2022-11-29 00:00 – Updated: 2025-04-16 17:42

Title

Cradlepoint IBR600 Command Injection

Summary

Cradlepoint IBR600 NCOS versions 6.5.0.160bc2e and prior are vulnerable to shell escape, which enables local attackers with non-superuser credentials to gain full, unrestrictive shell access which may allow an attacker to execute arbitrary code.

Severity ?

7.1 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

CWE

CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')

Assigner

icscert

References

URL

Tags

https://www.cisa.gov/uscert/ics/advisories/icsa-2…

Impacted products

	Vendor	Product	Version
	Cradlepoint	IBR600	Affected: 0 , ≤ 6.5.0.160bc2e (custom)

Credits

Uri Katz of Claroty Research reported these vulnerabilities to CISA.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T01:00:10.222Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-321-02"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-3086",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-16T17:25:49.176863Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-16T17:42:11.399Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "NetCloud OS (NCOS)"
          ],
          "product": "IBR600 ",
          "vendor": "Cradlepoint",
          "versions": [
            {
              "lessThanOrEqual": "6.5.0.160bc2e",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Uri Katz of Claroty Research reported these vulnerabilities to CISA."
        }
      ],
      "datePublic": "2022-11-17T23:32:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\nCradlepoint IBR600 NCOS versions 6.5.0.160bc2e and prior are vulnerable \nto shell escape, which enables local attackers with non-superuser \ncredentials to gain full, unrestrictive shell access which may allow an \nattacker to execute arbitrary code.\n\n"
            }
          ],
          "value": "Cradlepoint IBR600 NCOS versions 6.5.0.160bc2e and prior are vulnerable \nto shell escape, which enables local attackers with non-superuser \ncredentials to gain full, unrestrictive shell access which may allow an \nattacker to execute arbitrary code.\n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-77",
              "description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-12-07T23:34:24.434Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-321-02"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\u003cp\u003eCradlepoint recommends users to update to at least version: \u003c/p\u003e\n\n\u003cul\u003e\u003cli\u003eNCOS v7.22.70\u003c/li\u003e\n\u003c/ul\u003e\u003cp\u003eNCOS release 7.1.0 and greater are no longer available for \nmanual or offline download and are performed via the NetCloud Manager, \nwhich requires a subscription. For more information and NCOS upgrade \nbest practices visit \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://cradlepoint.com/products/netcloud-service/\"\u003eCradlepoint Netcloud Service\u003c/a\u003e\u003cspan style=\"background-color: var(--wht);\"\u003e.\u003c/span\u003e\u003c/p\u003e\n\n\u003cp\u003eFor more information about the latest update, see the \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://d2c9o94y5j661e.cloudfront.net/FW-ReleaseNotesNCOS7.22.70-050722.pdf\"\u003eCradlepoint Release Notes\u003c/a\u003e\u003cspan style=\"background-color: var(--wht);\"\u003e.\u003c/span\u003e\u003c/p\u003e"
            }
          ],
          "value": "Cradlepoint recommends users to update to at least version: \n\n\n\n  *  NCOS v7.22.70\n\n\n\nNCOS release 7.1.0 and greater are no longer available for \nmanual or offline download and are performed via the NetCloud Manager, \nwhich requires a subscription. For more information and NCOS upgrade \nbest practices visit  Cradlepoint Netcloud Service https://cradlepoint.com/products/netcloud-service/ .\n\n\n\nFor more information about the latest update, see the  Cradlepoint Release Notes https://d2c9o94y5j661e.cloudfront.net/FW-ReleaseNotesNCOS7.22.70-050722.pdf .\n\n"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Cradlepoint IBR600 Command Injection",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2022-3086",
    "datePublished": "2022-11-29T00:00:00.000Z",
    "dateReserved": "2022-09-01T00:00:00.000Z",
    "dateUpdated": "2025-04-16T17:42:11.399Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CERTFR-2022-AVI-1061

Solution

CVE-2022-3086 (GCVE-0-2022-3086)

Tags

Sightings

Nomenclature