Vulnerability · Published Aug 17, 2022 · Assigned by icscert
CVE-2022-2334Softing Secure Integration Server Uncontrolled Search Path Element
High 7.2
In plain English
A high-severity uncontrolled search path in Secure Integration Server from Softing. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 12.1% (higher than 96% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit.
Severity (CVSS 3.1)7.2High
Exploit odds (30 days)12.1%top 3.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Metasploit
Official description
The application searches for a library dll that is not found. If an attacker can place a dll with this name, then the attacker can leverage it to execute arbitrary code on the targeted Softing Secure Integration Server V1.22.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Softing | Secure Integration Server | V1.22 |
Weakness: CWE-427 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
References
- https://www.cisa.gov/uscert/ics/advisories/icsa-22-228-04 x_refsource_CONFIRM
- https://industrial.softing.com/fileadmin/psirt/downloads/syt-2022-5.html x_refsource_CONFIRM