CVE-2022-32515

A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could cause brute force attacks to take over the admin account when the product does not implement a rate limit mechanism on the admin authentication form. Affected Products: Conext™ ComBox (All Versions)

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-165-03_ConextCombox_Security_Notification.pdf	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:schneider-electric:conext_combox_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:schneider-electric:conext_combox:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2023-01-30 23:15

Updated : 2024-02-28 19:51

NVD link : CVE-2022-32515

Mitre link : CVE-2022-32515

CVE.ORG link : CVE-2022-32515

JSON object : View

Products Affected

schneider-electric

conext_combox
conext_combox_firmware

CWE

CWE-307

Improper Restriction of Excessive Authentication Attempts

{"id": "CVE-2022-32515", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "cybersecurity@se.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 3.9}]}, "published": "2023-01-30T23:15:10.083", "references": [{"url": "https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-165-03_ConextCombox_Security_Notification.pdf", "tags": ["Vendor Advisory"], "source": "cybersecurity@se.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "cybersecurity@se.com", "description": [{"lang": "en", "value": "CWE-307"}]}], "descriptions": [{"lang": "en", "value": "A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could cause brute force attacks to take over the admin account when the product does not implement a rate limit mechanism on the admin authentication form. Affected Products: Conext\u2122 ComBox (All Versions)"}, {"lang": "es", "value": "Existe una vulnerabilidad CWE-307: Restricci\u00f3n inadecuada de intentos de autenticaci\u00f3n excesivos que podr\u00eda provocar que ataques de fuerza bruta se apoderen de la cuenta de administrador cuando el producto no implementa un mecanismo de l\u00edmite de velocidad en el formulario de autenticaci\u00f3n de administrador. Productos afectados: Conext? ComBox (todas las versiones)"}], "lastModified": "2023-02-07T19:28:49.240", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:schneider-electric:conext_combox_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F973D511-EE72-4C64-B5CE-BB7E3C194413"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:schneider-electric:conext_combox:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "6F2F9562-402D-4069-83C0-E5C5CE05F2AB"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cybersecurity@se.com"}