Lucene search

K
nessusThis script is Copyright (C) 2022-2024 and is owned by Tenable, Inc. or an Affiliate thereof.SCADA_ADVANTECH_IVIEW_CVE-2022-2143.NBIN
HistoryAug 17, 2022 - 12:00 a.m.

Advantech iView runProViewUpgrade fwfilename Command Injection (CVE-2022-2143)

2022-08-1700:00:00
This script is Copyright (C) 2022-2024 and is owned by Tenable, Inc. or an Affiliate thereof.
www.tenable.com
23
advantech
iview
runproviewupgrade
fwfilename
command injection
cve-2022-2143
scanner

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.204 Low

EPSS

Percentile

96.4%

The Advantech iView running on the remote host is affected by a command injection vulnerability. An unauthenticated, remote attacker can exploit this, via a specially crafted message, to execute arbitrary code in the context of SYSTEM.

Binary data scada_advantech_iview_cve-2022-2143.nbin
VendorProductVersionCPE
advantechiviewcpe:/a:advantech:iview

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.204 Low

EPSS

Percentile

96.4%