Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 does not properly validate the input module name to the backup services of the software. This could allow a remote attacker to access sensitive functions of the application and execute arbitrary system commands.
References
| Link | Resource |
|---|---|
| https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-01 | Third Party Advisory US Government Resource |
| https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-01 | Third Party Advisory US Government Resource |
Configurations
History
21 Nov 2024, 07:32
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.1 |
| References | () https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-01 - Third Party Advisory, US Government Resource |
07 Nov 2023, 03:56
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 does not properly validate the input module name to the backup services of the software. This could allow a remote attacker to access sensitive functions of the application and execute arbitrary system commands. |
Information
Published : 2023-01-18 01:15
Updated : 2024-11-21 07:32
NVD link : CVE-2022-47911
Mitre link : CVE-2022-47911
CVE.ORG link : CVE-2022-47911
JSON object : View
Products Affected
sewio
- real-time_location_system_studio
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')