Vulnerability · Published Sep 6, 2022 · Assigned by icscert

CVE-2022-1368Cognex 3D-A1000 Dimensioning System Missing Authentication for Critical Function

Critical 9.8

In plain English

A critical-severity missing authentication in 3D-A1000 Dimensioning System from Cognex. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)1.0%top 37.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Cognex 3D-A1000 Dimensioning System in firmware version 1.0.3 (3354) and prior is vulnerable to CWE-306: Missing Authentication for Critical Function, which allows unauthorized users to change the operator account password via webserver commands by monitoring web socket communications from an unauthenticated session. This could allow an attacker to escalate privileges to match those of the compromised account.

Affected products (as reported)

Vendor	Product	Versions
Cognex	3D-A1000 Dimensioning System	all – through 1.0.3 (3354)

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://www.cisa.gov/uscert/ics/advisories/icsa-22-249-03 x_refsource_MISC