CVE-2022-1660
published 2022-06-02CVE-2022-1660: The affected products are vulnerable of untrusted data due to deserialization without prior authorization/authentication, which may allow an attacker to…
PriorityP269critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
15.97%
96.5th percentile
The affected products are vulnerable of untrusted data due to deserialization without prior authorization/authentication, which may allow an attacker to remotely execute arbitrary code.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| keysight | n6841a_rf_firmware | < 2.4.0 | 2.4.0 |
| keysight | n6854a_firmware | < 2.4.0 | 2.4.0 |
| keysight | n6854a_geolocation_server_and_n6841a_rf_sensor_software | >= all < 2.3.0 | 2.3.0 |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor and block inbound TCP connections on the port defined by the KEYSIGHT_SMS_PORT environment variable (default 8080) to detect or prevent exploitation of the unauthenticated deserialization endpoint on Keysight N6854A/N6841A RF software. ↗
- →Target is Keysight N6854A Geolocation server and N6841A RF Sensor software version 2.3.0 and earlier; exploitation requires no authentication or user interaction (CVSS AV:N/AC:L/PR:N/UI:N), making any inbound deserialization traffic to the service port highly suspicious. ↗
- ·The default service port (8080) can be overridden by the KEYSIGHT_SMS_PORT environment variable; defenders must check the actual environment variable value on deployed systems rather than assuming port 8080. ↗
- ·No known public exploits specifically target this vulnerability at the time of advisory publication, limiting available signature-based detection options. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-qfx2-fwx6-699g: The affected products are vulnerable of untrusted data due to deserialization without prior authorization/authentication, which may allow an attacker
ghsa_unreviewed·2022-06-03
CVE-2022-1660 [CRITICAL] CWE-502 GHSA-qfx2-fwx6-699g: The affected products are vulnerable of untrusted data due to deserialization without prior authorization/authentication, which may allow an attacker
The affected products are vulnerable of untrusted data due to deserialization without prior authorization/authentication, which may allow an attacker to remotely execute arbitrary code.
CISA ICS
Keysight N6854A Geolocation server and N6841A RF Sensor software
cisa_ics·2022-05-27·CVSS 9.8
[CRITICAL] Keysight N6854A Geolocation server and N6841A RF Sensor software
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Keysight N6854A Geolocation server and N6841A RF Sensor software
Last RevisedMay 27, 2022
Alert CodeICSA-22-146-01
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Keysight Technologies, Inc.
- Equipment: N6854A Geolocation server and N6841A RF Sensor software
- Vulnerabilities: Relative Path Traversal, Deserialization of Untrusted Data
## 2. RISK EVALUATION
Successful exploitation of these vulnerabilities could allow an attacker to obtain arbitrary operating system files and execute arbitrary code.
## 3. TECHNICAL DE
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-06-02
Published