CVE-2022-3091

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2022-3091", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "state": "PUBLISHED", "assignerShortName": "icscert", "dateReserved": "2022-09-01T18:59:32.526Z", "datePublished": "2023-01-17T16:21:57.537Z", "dateUpdated": "2025-01-16T22:01:20.020Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Equipment Predictive Maintenance Solution", "vendor": "RONDS", "versions": [{"status": "affected", "version": "1.19.5 "}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "TsungShu Chiu of CHT Security reported these vulnerabilities to CISA. "}], "datePublic": "2023-01-12T16:21:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\nRONDS EPM version 1.19.5 has a vulnerability in which a function could \nallow unauthenticated users to leak credentials. In some circumstances, \nan attacker can exploit this vulnerability to execute operating system \n(OS) commands. \n\n<p></p>"}], "value": "RONDS EPM version 1.19.5 has a vulnerability in which a function could \nallow unauthenticated users to leak credentials. In some circumstances, \nan attacker can exploit this vulnerability to execute operating system \n(OS) commands. \n\n\n\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2023-01-17T16:21:57.537Z"}, "references": [{"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-02"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n\n<p>RONDS provides the software to users that purchase their products and recommends users upgrade the software to version 1.35.21.</p>"}], "value": "\nRONDS provides the software to users that purchase their products and recommends users upgrade the software to version 1.35.21.\n\n"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T01:00:10.612Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-02", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-01-16T20:57:22.457108Z", "id": "CVE-2022-3091", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-16T22:01:20.020Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-02", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T01:00:10.612Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-3091", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-01-16T20:57:22.457108Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-16T20:57:24.056Z"}}], "cna": {"source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "TsungShu Chiu of CHT Security reported these vulnerabilities to CISA. "}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "RONDS", "product": "Equipment Predictive Maintenance Solution", "versions": [{"status": "affected", "version": "1.19.5 "}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "\nRONDS provides the software to users that purchase their products and recommends users upgrade the software to version 1.35.21.\n\n", "supportingMedia": [{"type": "text/html", "value": "\n\n<p>RONDS provides the software to users that purchase their products and recommends users upgrade the software to version 1.35.21.</p>", "base64": false}]}], "datePublic": "2023-01-12T16:21:00.000Z", "references": [{"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-02"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "RONDS EPM version 1.19.5 has a vulnerability in which a function could \nallow unauthenticated users to leak credentials. In some circumstances, \nan attacker can exploit this vulnerability to execute operating system \n(OS) commands. \n\n\n\n", "supportingMedia": [{"type": "text/html", "value": "\nRONDS EPM version 1.19.5 has a vulnerability in which a function could \nallow unauthenticated users to leak credentials. In some circumstances, \nan attacker can exploit this vulnerability to execute operating system \n(OS) commands. \n\n<p></p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2023-01-17T16:21:57.537Z"}}}, "cveMetadata": {"cveId": "CVE-2022-3091", "state": "PUBLISHED", "dateUpdated": "2025-01-16T22:01:20.020Z", "dateReserved": "2022-09-01T18:59:32.526Z", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "datePublished": "2023-01-17T16:21:57.537Z", "assignerShortName": "icscert"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Equipment Predictive Maintenance Solution", "vendor": "RONDS", "versions": [{"status": "affected", "version": "1.19.5 "}]}], "source": "ics-cert@hq.dhs.gov"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ronds:equipment_predictive_maintenance:1.19.5:*:*:*:*:*:*:*", "matchCriteriaId": "E989C2F6-A2EA-4CD9-B058-07164859F438", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "RONDS EPM version 1.19.5 has a vulnerability in which a function could \nallow unauthenticated users to leak credentials. In some circumstances, \nan attacker can exploit this vulnerability to execute operating system \n(OS) commands. \n\n\n\n"}, {"lang": "es", "value": "RONDS EPM versi\u00f3n 1.19.5 tiene una vulnerabilidad en la que una funci\u00f3n podr\u00eda permitir que usuarios no autenticados filtren credenciales. En algunas circunstancias, un atacante puede aprovechar esta vulnerabilidad para ejecutar comandos del sistema operativo (SO)."}], "id": "CVE-2022-3091", "lastModified": "2026-06-17T04:58:50.320", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2022-3091", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-01-16T20:57:22.457108Z", "version": "2.0.3"}}]}, "published": "2023-01-17T17:15:11.620", "references": [{"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-02"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-02"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}

{}

{}