« Volver al listado

CVE-2022-2634

Estado: ModificadaCrítica (9.8)—

Un atacante puede ser capaz de ejecutar acciones maliciosas debido a una falta de protecciones de acceso al dispositivo y permisos del dispositivo cuando es usada la aplicación web. Esto podría conllevar a una carga de archivos python que pueden ser ejecutados posteriormente

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Digi — Connectport X2D Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-2634",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-2634",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-16T15:53:46.897152Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "ics-cert@hq.dhs.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 10,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "ics-cert@hq.dhs.gov",
      "affectedData": [
        {
          "vendor": "Digi",
          "product": "ConnectPort X2D",
          "versions": [
            {
              "status": "affected",
              "version": "All manufactured prior to 01/2020"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-08-10T20:15:36.597",
  "references": [
    {
      "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-216-01",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "ics-cert@hq.dhs.gov"
    },
    {
      "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-216-01",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "ics-cert@hq.dhs.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-250"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An attacker may be able to execute malicious actions due to the lack of device access protections and device permissions when using the web application. This could lead to uploading python files which can be later executed."
    },
    {
      "lang": "es",
      "value": "Un atacante puede ser capaz de ejecutar acciones maliciosas debido a una falta de protecciones de acceso al dispositivo y permisos del dispositivo cuando es usada la aplicación web. Esto podría conllevar a una carga de archivos python que pueden ser ejecutados posteriormente"
    }
  ],
  "lastModified": "2026-06-17T04:42:15.153",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:digi:connectport_x2d_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "95C24E8F-B481-488B-AD36-C0D3965681A5",
              "versionEndExcluding": "2020-01-01"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:digi:connectport_x2d:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "47289275-83A0-4501-8F11-491CA7D16AD8"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "ics-cert@hq.dhs.gov"
}