CVE-2022-2475

2022-10-2818:15:11

CWE-1220

[email protected]

web.nvd.nist.gov

haas controller

access control

ethernet q commands

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

36.9%

JSON

Haas Controller version 100.20.000.1110 has insufficient granularity of access control when using the “Ethernet Q Commands” service. Any user is able to write macros into registers outside of the authorized accessible range. This could allow a user to access privileged resources or resources out of context.

Affected configurations

Nvd

Node

haascnchaas_controller_firmwareMatch100.20.000.1110

AND

haascnchaas_controllerMatch-

VendorProductVersionCPE
haascnchaas_controller_firmware100.20.000.1110cpe:2.3:o:haascnc:haas_controller_firmware:100.20.000.1110:*:*:*:*:*:*:*
haascnchaas_controller-cpe:2.3:h:haascnc:haas_controller:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
haascnc	haas_controller_firmware	100.20.000.1110	cpe:2.3:o:haascnc:haas_controller_firmware:100.20.000.1110:::::::*
haascnc	haas_controller	-	cpe:2.3:h:haascnc:haas_controller:-:::::::*