CVE-2022-40629

This vulnerability exists in Tacitine Firewall, all versions of EN6200-PRIME QUAD-35 and EN6200-PRIME QUAD-100 between 19.1.1 to 22.20.1 (inclusive), due to insecure design in the Tacitine Firewall web-based management interface. An unauthenticated remote attacker could exploit this vulnerability by sending a specially crafted http request on the targeted device. Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to view sensitive information on the targeted device.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://tacitine.com/newdownload/CVE-2022-40629.pdf	Vendor Advisory
https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2022-0363	Third Party Advisory
https://tacitine.com/newdownload/CVE-2022-40629.pdf	Vendor Advisory
https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2022-0363	Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:tacitine:en6200-prime_quad-35_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tacitine:en6200-prime_quad-35:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:tacitine:en6200-prime_quad-100_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tacitine:en6200-prime_quad-100:-:*:*:*:*:*:*:*

History

21 Nov 2024, 07:21

Type	Values Removed	Values Added
References	~~() https://tacitine.com/newdownload/CVE-2022-40629.pdf - Vendor Advisory~~	() https://tacitine.com/newdownload/CVE-2022-40629.pdf - Vendor Advisory
References	~~() https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2022-0363 - Third Party Advisory~~	() https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2022-0363 - Third Party Advisory

Information

Published : 2022-09-23 18:15

Updated : 2024-11-21 07:21

NVD link : CVE-2022-40629

Mitre link : CVE-2022-40629

CVE.ORG link : CVE-2022-40629

JSON object : View

Products Affected

tacitine

en6200-prime_quad-100
en6200-prime_quad-35_firmware
en6200-prime_quad-100_firmware
en6200-prime_quad-35

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

NVD-CWE-noinfo

{"id": "CVE-2022-40629", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "vdisclose@cert-in.org.in", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2022-09-23T18:15:11.420", "references": [{"url": "https://tacitine.com/newdownload/CVE-2022-40629.pdf", "tags": ["Vendor Advisory"], "source": "vdisclose@cert-in.org.in"}, {"url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2022-0363", "tags": ["Third Party Advisory"], "source": "vdisclose@cert-in.org.in"}, {"url": "https://tacitine.com/newdownload/CVE-2022-40629.pdf", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2022-0363", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "vdisclose@cert-in.org.in", "description": [{"lang": "en", "value": "CWE-200"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "This vulnerability exists in Tacitine Firewall, all versions of EN6200-PRIME QUAD-35 and EN6200-PRIME QUAD-100 between 19.1.1 to 22.20.1 (inclusive), due to insecure design in the Tacitine Firewall web-based management interface. An unauthenticated remote attacker could exploit this vulnerability by sending a specially crafted http request on the targeted device. Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to view sensitive information on the targeted device."}, {"lang": "es", "value": "Esta vulnerabilidad se presenta en Tacitine Firewall, en todas las versiones de EN6200-PRIME QUAD-35 y EN6200-PRIME QUAD-100 entre 19.1.1 y 22.20.1 (incluy\u00e9ndola), debido a un dise\u00f1o no seguro en la interfaz de administraci\u00f3n basada en web de Tacitine Firewall. Un atacante remoto no autenticado podr\u00eda explotar esta vulnerabilidad mediante el env\u00edo de una petici\u00f3n http especialmente dise\u00f1ada en el dispositivo objetivo. Una explotaci\u00f3n con \u00e9xito de esta vulnerabilidad podr\u00eda permitir a un atacante remoto no autenticado ver informaci\u00f3n confidencial en el dispositivo objetivo."}], "lastModified": "2024-11-21T07:21:44.513", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:tacitine:en6200-prime_quad-35_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6E36CCE1-EE57-4509-A5EA-A661AB0D28BE", "versionEndExcluding": "22.21.2", "versionStartIncluding": "19.1.1"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:tacitine:en6200-prime_quad-35:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "83F89827-7182-4C0F-8AF9-F93FECCA4DEC"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:tacitine:en6200-prime_quad-100_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4EDF36CA-FC59-4CB9-B562-5E6EB2102319", "versionEndExcluding": "22.21.2", "versionStartIncluding": "19.1.1"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:tacitine:en6200-prime_quad-100:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "2071D6CD-7708-46EC-9B09-F0BC9A1626C9"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "vdisclose@cert-in.org.in"}