Vulnerability · Published Nov 13, 2022 · Assigned by VulDB

CVE-2022-3976MZ Automation libiec61850 MMS File Services mms_client_files.c path traversal

Medium 5.5

In plain English

A medium-severity path traversal in libiec61850 from MZ Automation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 3.1)5.5Medium

Exploit odds (30 days)0.5%top 57.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability has been found in MZ Automation libiec61850 up to 1.4 and classified as critical. This vulnerability affects unknown code of the file src/mms/iso_mms/client/mms_client_files.c of the component MMS File Services. The manipulation of the argument filename leads to path traversal. Upgrading to version 1.5 is able to address this issue. The name of the patch is 10622ba36bb3910c151348f1569f039ecdd8786f. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-213556.

Affected products (as reported)

Vendor	Product	Versions
MZ Automation	libiec61850	1.01.11.21.31.4

Weakness: CWE-22 · Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

In plain English

Official description

Affected products (as reported)

References