github - ghsa-36g6-rvxx-r5jm

GHSA-36G6-RVXX-R5JM

Vulnerability from github – Published: 2022-09-10 00:00 – Updated: 2022-09-16 00:00

Details

The Baxter Spectrum WBM (v16, v16D38) and Baxter Spectrum WBM (v17, v17D19, v20D29 to v20D32) when in superuser mode is susceptible to format string attacks via application messaging. An attacker could use this to read memory in the WBM to access sensitive information.

Severity ?

6.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2022-26392"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-134"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-09-09T15:15:00Z",
    "severity": "MODERATE"
  },
  "details": "The Baxter Spectrum WBM (v16, v16D38) and Baxter Spectrum WBM (v17, v17D19, v20D29 to v20D32) when in superuser mode is susceptible to format string attacks via application messaging. An attacker could use this to read memory in the WBM to access sensitive information.",
  "id": "GHSA-36g6-rvxx-r5jm",
  "modified": "2022-09-16T00:00:38Z",
  "published": "2022-09-10T00:00:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-26392"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/uscert/ics/advisories/icsma-22-251-01"
    },
    {
      "type": "WEB",
      "url": "https://www.us-cert.gov/ics/advisories/icsma-22-xxx-xx"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2022-26392 (GCVE-0-2022-26392)

Vulnerability from cvelistv5 – Published: 2022-09-09 14:40 – Updated: 2024-09-17 02:31

Summary

Severity ?

3.1 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

CWE

CWE-134 - Use of Externally-Controlled Format String

Assigner

Baxter

References

URL

Tags

https://www.us-cert.gov/ics/advisories/icsma-22-xxx-xx

x_refsource_MISC

Impacted products

	Vendor	Product	Version
	Baxter	Baxter Spectrum Wireless Battery Module (WBM)	Affected: 16 Affected: 16D38 Affected: 17 Affected: 17D19 Affected: 20D29 Affected: 20D30 Affected: 20D31 Affected: 20D32

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T05:03:32.850Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.us-cert.gov/ics/advisories/icsma-22-xxx-xx"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Baxter Spectrum Wireless Battery Module (WBM)",
          "vendor": "Baxter",
          "versions": [
            {
              "status": "affected",
              "version": "16"
            },
            {
              "status": "affected",
              "version": "16D38"
            },
            {
              "status": "affected",
              "version": "17"
            },
            {
              "status": "affected",
              "version": "17D19"
            },
            {
              "status": "affected",
              "version": "20D29"
            },
            {
              "status": "affected",
              "version": "20D30"
            },
            {
              "status": "affected",
              "version": "20D31"
            },
            {
              "status": "affected",
              "version": "20D32"
            }
          ]
        }
      ],
      "datePublic": "2022-09-08T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The Baxter Spectrum WBM (v16, v16D38) and Baxter Spectrum WBM (v17, v17D19, v20D29 to v20D32) when in superuser mode is susceptible to format string attacks via application messaging. An attacker could use this to read memory in the WBM to access sensitive information."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-134",
              "description": "CWE-134 Use of Externally-Controlled Format String",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-09-09T14:40:06",
        "orgId": "dba971b9-eb30-4121-91e1-3b45611354aa",
        "shortName": "Baxter"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.us-cert.gov/ics/advisories/icsma-22-xxx-xx"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Format String vulnerability",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "productsecurity@baxter.com",
          "DATE_PUBLIC": "2022-09-08T22:03:00.000Z",
          "ID": "CVE-2022-26392",
          "STATE": "PUBLIC",
          "TITLE": "Format String vulnerability"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Baxter Spectrum Wireless Battery Module (WBM)",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_name": "16",
                            "version_value": ""
                          },
                          {
                            "version_affected": "=",
                            "version_name": "16D38",
                            "version_value": ""
                          },
                          {
                            "version_affected": "=",
                            "version_name": "17",
                            "version_value": ""
                          },
                          {
                            "version_affected": "=",
                            "version_name": "17D19",
                            "version_value": ""
                          },
                          {
                            "version_affected": "=",
                            "version_name": "20D29",
                            "version_value": ""
                          },
                          {
                            "version_affected": "=",
                            "version_name": "20D30",
                            "version_value": ""
                          },
                          {
                            "version_affected": "=",
                            "version_name": "20D31",
                            "version_value": ""
                          },
                          {
                            "version_affected": "=",
                            "version_name": "20D32",
                            "version_value": ""
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Baxter"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Baxter Spectrum WBM (v16, v16D38) and Baxter Spectrum WBM (v17, v17D19, v20D29 to v20D32) when in superuser mode is susceptible to format string attacks via application messaging. An attacker could use this to read memory in the WBM to access sensitive information."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-134 Use of Externally-Controlled Format String"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.us-cert.gov/ics/advisories/icsma-22-xxx-xx",
              "refsource": "MISC",
              "url": "https://www.us-cert.gov/ics/advisories/icsma-22-xxx-xx"
            }
          ]
        },
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dba971b9-eb30-4121-91e1-3b45611354aa",
    "assignerShortName": "Baxter",
    "cveId": "CVE-2022-26392",
    "datePublished": "2022-09-09T14:40:06.166154Z",
    "dateReserved": "2022-03-03T00:00:00",
    "dateUpdated": "2024-09-17T02:31:43.990Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-36G6-RVXX-R5JM

CVE-2022-26392 (GCVE-0-2022-26392)

Tags

Sightings

Nomenclature