The Cognex 3D-A1000 Dimensioning System in firmware version 1.0.3 (3354) and prior is vulnerable to CWE-306: Missing Authentication for Critical Function, which allows unauthorized users to change the operator account password via webserver commands by monitoring web socket communications from an unauthenticated session. This could allow an attacker to escalate privileges to match those of the compromised account.
References
Link | Resource |
---|---|
https://www.cisa.gov/uscert/ics/advisories/icsa-22-249-03 | Third Party Advisory US Government Resource |
https://www.cisa.gov/uscert/ics/advisories/icsa-22-249-03 | Third Party Advisory US Government Resource |
Configurations
Configuration 1 (hide)
AND |
|
History
21 Nov 2024, 06:40
Type | Values Removed | Values Added |
---|---|---|
References | () https://www.cisa.gov/uscert/ics/advisories/icsa-22-249-03 - Third Party Advisory, US Government Resource |
Information
Published : 2022-09-06 23:15
Updated : 2024-11-21 06:40
NVD link : CVE-2022-1368
Mitre link : CVE-2022-1368
CVE.ORG link : CVE-2022-1368
JSON object : View
Products Affected
cognex
- 3d-a1000_dimensioning_system_firmware
- 3d-a1000_dimensioning_system
CWE
CWE-306
Missing Authentication for Critical Function