Vulnerability · Published Jul 11, 2022 · Assigned by CERTVDE
CVE-2022-2302LENZE: Missing password verification in authorisation procedure
Critical 9.8
In plain English
A critical-severity security flaw in cabinet c520 from LENZE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 82% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)2.1%top 17.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Multiple Lenze products of the cabinet series skip the password verification upon second login. After a user has been logged on to the device once, a remote attacker can get full access without knowledge of the password.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| LENZE | cabinet c520 | V01.07.00.2757 – before V01.08.01.3021 |
| LENZE | cabinet c550 | V01.07.00.2757 – before V01.08.01.3021 |
| LENZE | cabinet c750 | V01.07.00.2757 – before V01.08.01.3021 |
Weakness: CWE-304 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://cert.vde.com/en/advisories/VDE-2022-030/ x_refsource_CONFIRM