« Volver al listado

CVE-2022-29897

Estado: ModificadaCrítica (9.1)—

On various RAD-ISM-900-EN-* devices by PHOENIX CONTACT an admin user could use the traceroute utility integrated in the WebUI to execute arbitrary code with root privileges on the OS due to an improper input validation in all versions of the firmware.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

Phoenixcontact — Rad-ism-900-en-bd-bus FirmwarePhoenixcontact — Rad-ism-900-en-bd/b FirmwarePhoenixcontact — Rad-ism-900-en-bd Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-29897",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
          "authentication": "SINGLE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "info@cert.vde.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9.1,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "info@cert.vde.com",
      "affectedData": [
        {
          "vendor": "PHOENIX CONTACT",
          "product": "RAD-ISM-900-EN-BD/B",
          "versions": [
            {
              "status": "affected",
              "version": "All Versions"
            }
          ]
        },
        {
          "vendor": "PHOENIX CONTACT",
          "product": "RAD-ISM-900-EN-BD",
          "versions": [
            {
              "status": "affected",
              "version": "All Versions"
            }
          ]
        },
        {
          "vendor": "PHOENIX CONTACT",
          "product": "RAD-ISM-900-EN-BD-BUS",
          "versions": [
            {
              "status": "affected",
              "version": "All Versions"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-05-11T15:15:09.990",
  "references": [
    {
      "url": "https://cert.vde.com/en/advisories/VDE-2022-018/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "info@cert.vde.com"
    },
    {
      "url": "https://cert.vde.com/en/advisories/VDE-2022-018/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "info@cert.vde.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "On various RAD-ISM-900-EN-* devices by PHOENIX CONTACT an admin user could use the traceroute utility integrated in the WebUI to execute arbitrary code with root privileges on the OS due to an improper input validation in all versions of the firmware."
    },
    {
      "lang": "es",
      "value": "En varios dispositivos RAD-ISM-900-EN-* de PHOENIX CONTACT un usuario administrador podía usar la utilidad traceroute integrada en la Interfaz de Usuario Web para ejecutar código arbitrario con privilegios de root en el Sistema Operativo debido a una comprobación de entrada inapropiada en todas las versiones del firmware"
    }
  ],
  "lastModified": "2026-06-17T04:40:55.350",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:phoenixcontact:rad-ism-900-en-bd_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9E340B2E-0A46-4E95-A766-CCBF66A595FB"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:phoenixcontact:rad-ism-900-en-bd:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "71C455BF-7562-43D5-B1D1-57B12F849872"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:phoenixcontact:rad-ism-900-en-bd\\/b_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F4F1A9B5-C99D-4E2A-95BF-7B4053F5D13E"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:phoenixcontact:rad-ism-900-en-bd\\/b:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "FEF17F84-8C87-48A5-A85E-879EE0F86649"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:phoenixcontact:rad-ism-900-en-bd-bus_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9703C8CB-086C-4FFA-8753-6C928096A5E6"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:phoenixcontact:rad-ism-900-en-bd-bus:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "2B220B2A-8289-4966-B4A3-DF981674D206"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "info@cert.vde.com"
}