CVE-2022-0183

Missing encryption of sensitive data vulnerability in 'MIRUPASS' PW10 firmware all versions and 'MIRUPASS' PW20 firmware all versions allows an attacker who can physically access the device to obtain the stored passwords.

CVSS v3 4.6 MEDIUM
CVSS v2.0 2.1 LOW

4.6^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.9 / Impact : 3.6

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

2.1^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://jvn.jp/en/jp/JVN19826500/index.html	Third Party Advisory
https://www.kingjim.co.jp/download/security/#mirupass	Vendor Advisory
https://jvn.jp/en/jp/JVN19826500/index.html	Third Party Advisory
https://www.kingjim.co.jp/download/security/#mirupass	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:kingjim:mirupass_pw10_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:kingjim:mirupass_pw10:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:kingjim:mirupass_pw20_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:kingjim:mirupass_pw20:-:*:*:*:*:*:*:*

History

21 Nov 2024, 06:38

Type	Values Removed	Values Added
References	~~() https://jvn.jp/en/jp/JVN19826500/index.html - Third Party Advisory~~	() https://jvn.jp/en/jp/JVN19826500/index.html - Third Party Advisory
References	~~() https://www.kingjim.co.jp/download/security/#mirupass - Vendor Advisory~~	() https://www.kingjim.co.jp/download/security/#mirupass - Vendor Advisory

Information

Published : 2022-01-17 10:15

Updated : 2024-11-21 06:38

NVD link : CVE-2022-0183

Mitre link : CVE-2022-0183

CVE.ORG link : CVE-2022-0183

JSON object : View

Products Affected

kingjim

mirupass_pw10
mirupass_pw20
mirupass_pw20_firmware
mirupass_pw10_firmware

CWE

CWE-311

Missing Encryption of Sensitive Data

{"id": "CVE-2022-0183", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.6, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 0.9}]}, "published": "2022-01-17T10:15:08.200", "references": [{"url": "https://jvn.jp/en/jp/JVN19826500/index.html", "tags": ["Third Party Advisory"], "source": "vultures@jpcert.or.jp"}, {"url": "https://www.kingjim.co.jp/download/security/#mirupass", "tags": ["Vendor Advisory"], "source": "vultures@jpcert.or.jp"}, {"url": "https://jvn.jp/en/jp/JVN19826500/index.html", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.kingjim.co.jp/download/security/#mirupass", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-311"}]}], "descriptions": [{"lang": "en", "value": "Missing encryption of sensitive data vulnerability in 'MIRUPASS' PW10 firmware all versions and 'MIRUPASS' PW20 firmware all versions allows an attacker who can physically access the device to obtain the stored passwords."}, {"lang": "es", "value": "Una vulnerabilidad de falta de cifrado de datos confidenciales en el firmware de \"MIRUPASS\" PW10 todas las versiones y en el firmware de \"MIRUPASS\" PW20 todas las versiones permite a un atacante que pueda acceder f\u00edsicamente al dispositivo obtener las contrase\u00f1as almacenadas"}], "lastModified": "2024-11-21T06:38:05.520", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:kingjim:mirupass_pw10_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E9FB74D3-B6AA-415E-9864-AEC01357401F"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:kingjim:mirupass_pw10:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A965B937-4E1D-40F6-947E-816BA0B48EE8"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:kingjim:mirupass_pw20_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "22A8DD2F-2606-4AD5-BE79-088B3A50D30A"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:kingjim:mirupass_pw20:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "00914630-3A9A-472D-8FA0-80FB046F7384"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "vultures@jpcert.or.jp"}