CVE-2022-48198

{"id": "CVE-2022-48198", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2023-01-01T07:15:10.187", "references": [{"url": "https://github.com/vooon/ntpd_driver/compare/1.2.0...1.3.0", "tags": ["Release Notes", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/vooon/ntpd_driver/compare/2.1.0...2.2.0", "tags": ["Release Notes", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/vooon/ntpd_driver/issues/9", "tags": ["Exploit", "Issue Tracking", "Patch", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/vooon/ntpd_driver/compare/1.2.0...1.3.0", "tags": ["Release Notes", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/vooon/ntpd_driver/compare/2.1.0...2.2.0", "tags": ["Release Notes", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/vooon/ntpd_driver/issues/9", "tags": ["Exploit", "Issue Tracking", "Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-668"}]}], "descriptions": [{"lang": "en", "value": "The ntpd_driver component before 1.3.0 and 2.x before 2.2.0 for Robot Operating System (ROS) allows attackers, who control the source code of a different node in the same ROS application, to change a robot's behavior. This occurs because a topic name depends on the attacker-controlled time_ref_topic parameter."}, {"lang": "es", "value": "El componente ntpd_driver anterior a 1.3.0 y 2.x anterior a 2.2.0 para Robot Operating System (ROS) permite a atacantes, que controlan el c\u00f3digo fuente de un nodo diferente en la misma aplicaci\u00f3n ROS, cambiar el comportamiento de un robot. Esto ocurre porque el nombre de un tema depende del par\u00e1metro time_ref_topic controlado por el atacante."}], "lastModified": "2024-11-21T07:32:58.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ntpd_driver_project:ntpd_driver:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8EB88AF8-C1A9-48C4-874E-16E4B631AE6D", "versionEndExcluding": "1.3.0"}, {"criteria": "cpe:2.3:a:ntpd_driver_project:ntpd_driver:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9BE4BD13-56AC-4C1F-A575-37BD38C006F9", "versionEndExcluding": "2.2.0", "versionStartIncluding": "2.0.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:openrobotics:robot_operating_system:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "BFEE12D7-4A38-466E-B8E0-D0FADBC00CE4"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}