CVE-2022-31765

CWE-862 — Missing Authorization3 documents3 sources
Severity
8.8HIGH
EPSS
0.4%
top 40.50%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
140
Siemens 6gk5804-0ap00-2aa2 FirmwareSiemens 6gk5812-1aa00-2aa2 FirmwareSiemens 6gk5812-1ba00-2aa2 Firmware+137 more
Timeline
PublishedOct 11

Description

Affected devices do not properly authorize the change password function of the web interface. This could allow low privileged users to escalate their privileges.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages140 packages

Patches

Patch: cert-portal.siemens.com ↗Patch: cert-portal.siemens.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-33vv-h74c-xmw5: Affected devices do not properly authorize the change password function of the web interface↗2022-10-11
▶
CVEList
CVE-2022-31765: Affected devices do not properly authorize the change password function of the web interface↗2022-10-11
▶