CVE-2022-3864 Vulnerability Details

  /     /     /  

CVE-2022-3864 Metadata Quick Info

CVE Published: 04/01/2024 | CVE Updated: 27/08/2024 | CVE Year: 2022
Source: Hitachi Energy | Vendor: Hitachi Energy | Product: Relion 670/650/SAM600-IO Series
Status : PUBLISHED

---

CVE-2022-3864 Description

A vulnerability exists in the Relion update package signature validation. A tampered update package could cause the IED to restart. After restart the device is back to normal operation. An attacker could exploit the vulnerability by first gaining access to the system with security privileges and attempt to update the IED with a malicious update package. Successful exploitation of this vulnerability will cause the IED to restart, causing a temporary Denial of Service.

Metrics

CVSS Version: 3.1 | Base Score: 4.5 MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H

l➤ Exploitability Metrics:
    Attack Vector (AV)* NETWORK
    Attack Complexity (AC)* LOW
    Privileges Required (PR)* HIGH
    User Interaction (UI)* REQUIRED
    Scope (S)* UNCHANGED

l➤ Impact Metrics:
    Confidentiality Impact (C)* NONE
    Integrity Impact (I)* NONE
    Availability Impact (A)* HIGH

Weakness Enumeration (CWE)

CWE-ID: CWE-347
CWE Name: CWE-347 Improper Verification of Cryptographic Signature
Source: Hitachi Energy

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID: CAPEC-186
CAPEC Description: CAPEC-186 Malicious Software Update


Source: NVD (National Vulnerability Database).