« Volver al listado

CVE-2022-29898

Estado: ModificadaCrítica (9.1)—

On various RAD-ISM-900-EN-* devices by PHOENIX CONTACT an admin user could use the configuration file uploader in the WebUI to execute arbitrary code with root privileges on the OS due to an improper validation of an integrity check value in all versions of the firmware.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

Phoenixcontact — Rad-ism-900-en-bd-bus FirmwarePhoenixcontact — Rad-ism-900-en-bd/b FirmwarePhoenixcontact — Rad-ism-900-en-bd Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-29898",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
          "authentication": "SINGLE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "info@cert.vde.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9.1,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "info@cert.vde.com",
      "affectedData": [
        {
          "vendor": "PHOENIX CONTACT",
          "product": "RAD-ISM-900-EN-BD/B",
          "versions": [
            {
              "status": "affected",
              "version": "All Versions"
            }
          ]
        },
        {
          "vendor": "PHOENIX CONTACT",
          "product": "RAD-ISM-900-EN-BD",
          "versions": [
            {
              "status": "affected",
              "version": "All Versions"
            }
          ]
        },
        {
          "vendor": "PHOENIX CONTACT",
          "product": "RAD-ISM-900-EN-BD-BUS",
          "versions": [
            {
              "status": "affected",
              "version": "All Versions"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-05-11T15:15:10.047",
  "references": [
    {
      "url": "https://cert.vde.com/en/advisories/VDE-2022-018/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "info@cert.vde.com"
    },
    {
      "url": "https://cert.vde.com/en/advisories/VDE-2022-018/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "info@cert.vde.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-354"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "On various RAD-ISM-900-EN-* devices by PHOENIX CONTACT an admin user could use the configuration file uploader in the WebUI to execute arbitrary code with root privileges on the OS due to an improper validation of an integrity check value in all versions of the firmware."
    },
    {
      "lang": "es",
      "value": "En varios dispositivos RAD-ISM-900-EN-* de PHOENIX CONTACT un usuario administrador podía usar el cargador de archivos de configuración en la Interfaz de Usuario Web para ejecutar código arbitrario con privilegios de root en el Sistema Operativo debido a una  comprobación inapropiada de un valor de verificación de integridad en todas las versiones del firmware"
    }
  ],
  "lastModified": "2026-06-17T04:40:55.460",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:phoenixcontact:rad-ism-900-en-bd_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9E340B2E-0A46-4E95-A766-CCBF66A595FB"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:phoenixcontact:rad-ism-900-en-bd:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "71C455BF-7562-43D5-B1D1-57B12F849872"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:phoenixcontact:rad-ism-900-en-bd\\/b_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F4F1A9B5-C99D-4E2A-95BF-7B4053F5D13E"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:phoenixcontact:rad-ism-900-en-bd\\/b:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "FEF17F84-8C87-48A5-A85E-879EE0F86649"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:phoenixcontact:rad-ism-900-en-bd-bus_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9703C8CB-086C-4FFA-8753-6C928096A5E6"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:phoenixcontact:rad-ism-900-en-bd-bus:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "2B220B2A-8289-4966-B4A3-DF981674D206"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "info@cert.vde.com"
}