certfr_avis - certfr-2022-avi-1045

CERTFR-2022-AVI-1045

Vulnerability from certfr_avis

Une vulnérabilité a été découverte dans les produits Moxa. Elle permet à un attaquant de provoquer une élévation de privilèges.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Moxa	UC-3100 Series	UC-3100 Series versions v1.0 à v1.6 sans le paquet moxa-version_1.3.3+deb9_armhf.deb
Moxa	N/A	UC-5100 Series versions v1.0 à v1.4 sans le paquet moxa-version_1.3.3+deb9_armhf.deb
Moxa	N/A	UC-2100-W Series versions v1.0 à v1.12 sans le paquet moxa-version_1.3.3+deb9_armhf.deb
Moxa	UC-8100A-ME-T Series	UC-8100A-ME-T Series versions v1.0 à v1.6 sans le paquet moxa-version_1.3.3+deb9_armhf.deb
Moxa	N/A	AIG-300 Series versions v1.0 à v1.4 sans la dernière version de ThingsPro Proxy
Moxa	N/A	UC-8100-ME-T Series versions v3.0 et v3.1 sans le paquet moxa-version_1.3.3+deb9_armhf.deb
Moxa	UC-8100 Series	UC-8100 Series versions v3.0 à v3.5 sans le paquet moxa-version_1.3.3+deb9_armhf.deb
Moxa	UC-8580 Series	UC-8580 Series (avec Debian 9) versions v2.0 et v2.1 sans le paquet moxa-version_1.3.3+deb9_armhf.deb
Moxa	UC-8410A Series	UC-8410A Series (avec Debian 9) versions v4.0.2 et v4.1.2 sans le paquet moxa-version_1.3.3+deb9_armhf.deb
Moxa	UC-2100 Series	UC-2100 Series versions v1.0 à v1.12 sans le paquet moxa-version_1.3.3+deb9_armhf.deb
Moxa	N/A	DA-662C-16-LX Series (GLB) versions v1.0.2 à 1.1.2 sans le paquet moxa-version_1.3.3+deb9_armhf.deb
Moxa	UC-8540 Series	UC-8540 Series (avec Debian 9) versions v2.0 et v2.1 sans le paquet moxa-version_1.3.3+deb9_armhf.deb
Moxa	UC-8200 Series	UC-8200 Series versions v1.0 à v1.5 sans le paquet moxa-version_1.3.3+deb9_armhf.deb

References

Title

Publication Time

Tags

Bulletin de sécurité Moxa du 22 novembre 2022

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "UC-3100 Series versions v1.0 \u00e0 v1.6 sans le paquet moxa-version_1.3.3+deb9_armhf.deb",
      "product": {
        "name": "UC-3100 Series",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "UC-5100 Series versions v1.0 \u00e0 v1.4 sans le paquet moxa-version_1.3.3+deb9_armhf.deb",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "UC-2100-W Series versions v1.0 \u00e0 v1.12 sans le paquet moxa-version_1.3.3+deb9_armhf.deb",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "UC-8100A-ME-T Series versions v1.0 \u00e0 v1.6 sans le paquet moxa-version_1.3.3+deb9_armhf.deb",
      "product": {
        "name": "UC-8100A-ME-T Series",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "AIG-300 Series versions v1.0 \u00e0 v1.4 sans la derni\u00e8re version de ThingsPro Proxy",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "UC-8100-ME-T Series versions v3.0 et v3.1 sans le paquet moxa-version_1.3.3+deb9_armhf.deb",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "UC-8100 Series versions v3.0 \u00e0 v3.5 sans le paquet moxa-version_1.3.3+deb9_armhf.deb",
      "product": {
        "name": "UC-8100 Series",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "UC-8580 Series (avec Debian 9) versions v2.0 et v2.1 sans le paquet moxa-version_1.3.3+deb9_armhf.deb",
      "product": {
        "name": "UC-8580 Series",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "UC-8410A Series (avec Debian 9) versions v4.0.2 et v4.1.2 sans le paquet moxa-version_1.3.3+deb9_armhf.deb",
      "product": {
        "name": "UC-8410A Series",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "UC-2100 Series versions v1.0 \u00e0 v1.12 sans le paquet moxa-version_1.3.3+deb9_armhf.deb",
      "product": {
        "name": "UC-2100 Series",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "DA-662C-16-LX Series (GLB) versions v1.0.2 \u00e0 1.1.2 sans le paquet moxa-version_1.3.3+deb9_armhf.deb",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "UC-8540 Series (avec Debian 9) versions v2.0 et v2.1 sans le paquet moxa-version_1.3.3+deb9_armhf.deb",
      "product": {
        "name": "UC-8540 Series",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    },
    {
      "description": "UC-8200 Series versions v1.0 \u00e0 v1.5 sans le paquet moxa-version_1.3.3+deb9_armhf.deb",
      "product": {
        "name": "UC-8200 Series",
        "vendor": {
          "name": "Moxa",
          "scada": true
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2022-3088",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-3088"
    }
  ],
  "initial_release_date": "2022-11-22T00:00:00",
  "last_revision_date": "2022-11-22T00:00:00",
  "links": [],
  "reference": "CERTFR-2022-AVI-1045",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2022-11-22T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans les produits Moxa. Elle permet \u00e0\nun attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans les produits Moxa",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Moxa du 22 novembre 2022",
      "url": "https://www.moxa.com/en/support/product-support/security-advisory/arm-based-computer-improper-privilege-management-vulnerability"
    }
  ]
}

CVE-2022-3088 (GCVE-0-2022-3088)

Vulnerability from cvelistv5

Published

2022-11-22 00:00

Modified

2025-04-16 17:42

Severity ?

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-250 - Execution with Unnecessary Privileges

Summary

UC-8100A-ME-T System Image: Versions v1.0 to v1.6, UC-2100 System Image: Versions v1.0 to v1.12, UC-2100-W System Image: Versions v1.0 to v 1.12, UC-3100 System Image: Versions v1.0 to v1.6, UC-5100 System Image: Versions v1.0 to v1.4, UC-8100 System Image: Versions v3.0 to v3.5, UC-8100-ME-T System Image: Versions v3.0 and v3.1, UC-8200 System Image: v1.0 to v1.5, AIG-300 System Image: v1.0 to v1.4, UC-8410A with Debian 9 System Image: Versions v4.0.2 and v4.1.2, UC-8580 with Debian 9 System Image: Versions v2.0 and v2.1, UC-8540 with Debian 9 System Image: Versions v2.0 and v2.1, and DA-662C-16-LX (GLB) System Image: Versions v1.0.2 to v1.1.2 of Moxa's ARM-based computers have an execution with unnecessary privileges vulnerability, which could allow an attacker with user-level privileges to gain root privileges.

References

URL

Tags

https://www.cisa.gov/uscert/ics/advisories/icsa-22-326-05

Impacted products

Vendor

Product

Version

Moxa

UC-8100A-ME-T System Imaage

Version: 1.0 <

Moxa	UC-2100 System Image	Version: 1.0 <
Moxa	UC-2100-W System Image	Version: 1.0 <
Moxa	UC-3100 System Image	Version: 1.0 <
Moxa	UC-5100 System Image	Version: 1.0 <
Moxa	UC-8100 System Image	Version: 3.0 <
Moxa	UC-8100-ME-T System Image	Version: 3.0 <
Moxa	UC-8200 System Image	Version: 1.0 <
Moxa	AIG-300 System Image	Version: 1.0 <
Moxa	UC-8410A with Debian 9 System Image	Version: 4.0.2 and 4.1.2
Moxa	UC-8580 with Debian 9 System Image	Version: 2.0 and 2.1
Moxa	UC-8540 with Debian 9 System Image	Version: 2.0 and 2.1
Moxa	DA-662C-16-LX (GLB) System Image	Version: 1.0.2 <

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T01:00:10.008Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-326-05"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-3088",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-16T17:25:51.797778Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-16T17:42:25.272Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "UC-8100A-ME-T System Imaage",
          "vendor": "Moxa",
          "versions": [
            {
              "lessThanOrEqual": "1.6",
              "status": "affected",
              "version": "1.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "UC-2100 System Image",
          "vendor": "Moxa",
          "versions": [
            {
              "lessThanOrEqual": "1.12",
              "status": "affected",
              "version": "1.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "UC-2100-W System Image",
          "vendor": "Moxa",
          "versions": [
            {
              "lessThanOrEqual": "1.12",
              "status": "affected",
              "version": "1.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "UC-3100 System Image",
          "vendor": "Moxa",
          "versions": [
            {
              "lessThanOrEqual": "1.6",
              "status": "affected",
              "version": "1.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "UC-5100 System Image",
          "vendor": "Moxa",
          "versions": [
            {
              "lessThanOrEqual": "1.4",
              "status": "affected",
              "version": "1.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "UC-8100 System Image",
          "vendor": "Moxa",
          "versions": [
            {
              "lessThanOrEqual": "3.5",
              "status": "affected",
              "version": "3.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "UC-8100-ME-T System Image",
          "vendor": "Moxa",
          "versions": [
            {
              "lessThanOrEqual": "3.1",
              "status": "affected",
              "version": "3.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "UC-8200 System Image",
          "vendor": "Moxa",
          "versions": [
            {
              "lessThanOrEqual": "1.5",
              "status": "affected",
              "version": "1.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "AIG-300 System Image",
          "vendor": "Moxa",
          "versions": [
            {
              "lessThanOrEqual": "1.4",
              "status": "affected",
              "version": "1.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "UC-8410A with Debian 9 System Image",
          "vendor": "Moxa",
          "versions": [
            {
              "status": "affected",
              "version": "4.0.2 and 4.1.2"
            }
          ]
        },
        {
          "product": "UC-8580 with Debian 9 System Image",
          "vendor": "Moxa",
          "versions": [
            {
              "status": "affected",
              "version": "2.0 and 2.1"
            }
          ]
        },
        {
          "product": "UC-8540 with Debian 9 System Image",
          "vendor": "Moxa",
          "versions": [
            {
              "status": "affected",
              "version": "2.0 and 2.1"
            }
          ]
        },
        {
          "product": "DA-662C-16-LX (GLB) System Image",
          "vendor": "Moxa",
          "versions": [
            {
              "lessThanOrEqual": "1.1.2",
              "status": "affected",
              "version": "1.0.2",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "En Garde ICSRange research team reported this vulnerability to CISA. "
        }
      ],
      "datePublic": "2022-11-22T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "UC-8100A-ME-T System Image: Versions v1.0 to v1.6, UC-2100 System Image: Versions v1.0 to v1.12, UC-2100-W System Image: Versions v1.0 to v 1.12,\u0026nbsp;UC-3100 System Image: Versions v1.0 to v1.6,\u0026nbsp;UC-5100 System Image: Versions v1.0 to v1.4, UC-8100 System Image: Versions v3.0 to v3.5, UC-8100-ME-T System Image: Versions v3.0 and v3.1, UC-8200 System Image: v1.0 to v1.5, AIG-300 System Image: v1.0 to v1.4, UC-8410A with Debian 9 System Image: Versions v4.0.2 and v4.1.2, UC-8580 with Debian 9 System Image: Versions v2.0 and v2.1, UC-8540 with Debian 9 System Image: Versions v2.0 and v2.1, and DA-662C-16-LX (GLB) System Image: Versions v1.0.2 to v1.1.2 of Moxa\u0027s ARM-based computers have an execution with unnecessary privileges vulnerability, which could allow an attacker with user-level privileges to gain root privileges."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-250",
              "description": "CWE-250 Execution with Unnecessary Privileges",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-12-07T00:00:00.000Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-326-05"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Moxa developed updates to address this vulnerability. Users should follow the instructions in Moxa\u0027s security advisory to update their system image.  "
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2022-3088",
    "datePublished": "2022-11-22T00:00:00.000Z",
    "dateReserved": "2022-09-01T00:00:00.000Z",
    "dateUpdated": "2025-04-16T17:42:25.272Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CERTFR-2022-AVI-1045

Vulnerability from certfr_avis

Solution

CVE-2022-3088 (GCVE-0-2022-3088)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature