Sign-up

ID

VAR-202207-1525


CVE

CVE-2022-29834


TITLE

ICONICS, Inc.  of  GENESIS 64  Past traversal vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2022-013562

DESCRIPTION

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ICONICS GENESIS64 versions 10.97 to 10.97.1 allows a remote unauthenticated attacker to access to arbitrary files in the GENESIS64 server and disclose information stored in the files by embedding a malicious URL parameter in the URL of the monitoring screen delivered to the GENESIS64 mobile monitoring application and accessing the monitoring screen. ICONICS, Inc. of GENESIS 64 Exists in a past traversal vulnerability.Information may be obtained. This vulnerability allows remote attackers to disclose sensitive information on affected installations of ICONICS GENESIS64. Authentication is not required to exploit this vulnerability.The specific flaw exists within the colorpalletes endpoint. When parsing the path parameter, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise

Trust: 2.34

sources: NVD: CVE-2022-29834 // JVNDB: JVNDB-2022-013562 // ZDI: ZDI-22-1042 // VULMON: CVE-2022-29834

AFFECTED PRODUCTS

vendor:iconicsmodel:genesis64scope:eqversion:10.97.1

Trust: 1.0

vendor:iconicsmodel:genesis64scope:eqversion:10.97

Trust: 1.0

vendor:iconicsmodel:genesis 64scope:eqversion: -

Trust: 0.8

vendor:iconicsmodel:genesis 64scope: - version: -

Trust: 0.8

vendor:iconicsmodel:genesis 64scope:eqversion:10.97

Trust: 0.8

vendor:iconicsmodel:genesis 64scope:eqversion:10.97.1

Trust: 0.8

vendor:iconicsmodel:genesis64scope: - version: -

Trust: 0.7

sources: ZDI: ZDI-22-1042 // JVNDB: JVNDB-2022-013562 // NVD: CVE-2022-29834

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD: CVE-2022-29834
value: HIGH

Trust: 1.8

ZDI: CVE-2022-29834
value: HIGH

Trust: 0.7

CNNVD: CNNVD-202207-2084
value: HIGH

Trust: 0.6

NVD: CVE-2022-29834
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.1

Trust: 1.0

NVD: CVE-2022-29834
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

ZDI: CVE-2022-29834
baseSeverity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.0

Trust: 0.7

sources: ZDI: ZDI-22-1042 // JVNDB: JVNDB-2022-013562 // NVD: CVE-2022-29834 // CNNVD: CNNVD-202207-2084

PROBLEMTYPE DATA

problemtype:CWE-22

Trust: 1.0

problemtype:Path traversal (CWE-22) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2022-013562 // NVD: CVE-2022-29834

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202207-2084

TYPE

path traversal

Trust: 0.6

sources: CNNVD: CNNVD-202207-2084

CONFIGURATIONS

sources:
            
            
            NVD: CVE-2022-29834

PATCH
title:ICONICS has issued an update to correct this vulnerability.url:https://www.cisa.gov/uscert/ics/advisories/icsa-22-202-04
Trust: 0.7
title:ICONICS GENESIS64 Repair measures for path traversal vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=201701
Trust: 0.6
sources:
            
            
            ZDI: ZDI-22-1042 // 
            
            
            
            CNNVD: CNNVD-202207-2084

EXTERNAL IDS
db:NVDid:CVE-2022-29834
Trust: 4.0
db:JVNid:JVNVU96480474
Trust: 2.5
db:ICS CERTid:ICSA-22-202-04
Trust: 1.5
db:JVNDBid:JVNDB-2022-013562
Trust: 0.8
db:ZDI_CANid:ZDI-CAN-16509
Trust: 0.7
db:ZDIid:ZDI-22-1042
Trust: 0.7
db:CS-HELPid:SB2022072541
Trust: 0.6
db:CNNVDid:CNNVD-202207-2084
Trust: 0.6
db:VULMONid:CVE-2022-29834
Trust: 0.1
sources:
            
            
            ZDI: ZDI-22-1042 // 
            
            
            
            VULMON: CVE-2022-29834 // 
            
            
            
            JVNDB: JVNDB-2022-013562 // 
            
            
            
            NVD: CVE-2022-29834 // 
            
            
            
            CNNVD: CNNVD-202207-2084

REFERENCES
url:https://jvn.jp/vu/jvnvu96480474/index.html
Trust: 2.5
url:https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-008_en.pdf
Trust: 2.5
url:https://www.cisa.gov/uscert/ics/advisories/icsa-22-202-04
Trust: 0.8
url:https://jvn.jp/vu/jvnvu96480474/
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2022-29834
Trust: 0.8
url:https://www.cisa.gov/news-events/ics-advisories/icsa-22-202-04
Trust: 0.8
url:https://cxsecurity.com/cveshow/cve-2022-29834/
Trust: 0.6
url:https://www.cybersecurity-help.cz/vdb/sb2022072541
Trust: 0.6
url:https://us-cert.cisa.gov/ics/advisories/icsa-22-202-04
Trust: 0.6
url:https://nvd.nist.gov
Trust: 0.1
sources:
            
            
            ZDI: ZDI-22-1042 // 
            
            
            
            VULMON: CVE-2022-29834 // 
            
            
            
            JVNDB: JVNDB-2022-013562 // 
            
            
            
            NVD: CVE-2022-29834 // 
            
            
            
            CNNVD: CNNVD-202207-2084

CREDITS
Chris Anastasio and Steven Seeley of Incite Team
Trust: 0.7
sources:
            
            
            ZDI: ZDI-22-1042

SOURCES
db:ZDIid:ZDI-22-1042
db:VULMONid:CVE-2022-29834
db:JVNDBid:JVNDB-2022-013562
db:NVDid:CVE-2022-29834
db:CNNVDid:CNNVD-202207-2084

LAST UPDATE DATE
2023-09-10T22:31:27.917000+00:00

SOURCES UPDATE DATE
db:ZDIid:ZDI-22-1042date:2022-08-03T00:00:00
db:VULMONid:CVE-2022-29834date:2022-07-20T00:00:00
db:JVNDBid:JVNDB-2022-013562date:2023-09-08T08:29:00
db:NVDid:CVE-2022-29834date:2022-07-27T18:57:00
db:CNNVDid:CNNVD-202207-2084date:2022-07-28T00:00:00

SOURCES RELEASE DATE
db:ZDIid:ZDI-22-1042date:2022-08-03T00:00:00
db:VULMONid:CVE-2022-29834date:2022-07-20T00:00:00
db:JVNDBid:JVNDB-2022-013562date:2023-09-08T00:00:00
db:NVDid:CVE-2022-29834date:2022-07-20T17:15:00
db:CNNVDid:CNNVD-202207-2084date:2022-07-20T00:00:00