There is a CSRF vulnerability on Netman-204 version 02.05. An attacker could manage to change administrator passwords through a Cross Site Request Forgery due to the lack of proper validation on the CRSF token. This vulnerability could allow a remote attacker to access the administrator panel, being able to modify different parameters that are critical for industrial operations.
References
| Link | Resource |
|---|---|
| https://www.incibe.es/en/incibe-cert/notices/aviso-sci/cross-site-request-forgery-csrf-riello-ups-netman-204 | Third Party Advisory |
| https://www.incibe.es/en/incibe-cert/notices/aviso-sci/cross-site-request-forgery-csrf-riello-ups-netman-204 | Third Party Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
21 Nov 2024, 07:19
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://www.incibe.es/en/incibe-cert/notices/aviso-sci/cross-site-request-forgery-csrf-riello-ups-netman-204 - Third Party Advisory |
28 Jun 2023, 17:45
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://www.incibe.es/en/incibe-cert/notices/aviso-sci/cross-site-request-forgery-csrf-riello-ups-netman-204 - Third Party Advisory | |
| First Time |
Riello-ups
Riello-ups netman 204 Riello-ups netman 204 Firmware |
|
| CPE | cpe:2.3:h:riello-ups:netman_204:-:*:*:*:*:*:*:* cpe:2.3:o:riello-ups:netman_204_firmware:02.05:*:*:*:*:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
| CWE | CWE-352 |
21 Jun 2023, 13:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-06-21 13:15
Updated : 2024-11-21 07:19
NVD link : CVE-2022-3372
Mitre link : CVE-2022-3372
CVE.ORG link : CVE-2022-3372
JSON object : View
Products Affected
riello-ups
- netman_204_firmware
- netman_204
CWE
CWE-352
Cross-Site Request Forgery (CSRF)