What is the CVSS score of CVE-2022-2006?

CVE-2022-2006 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2022-2006?

Yes, a patch is available for CVE-2022-2006. Update the affected software to the latest version immediately.

C More Ea9 T6Cl Firmware CVE-2022-2006

HIGH

Uncontrolled Search Path Element (CWE-427)

2022-08-31 ics-cert@hq.dhs.gov

Information Disclosure C More Ea9 T6Cl Firmware C More Ea9 T6Cl R Firmware C More Ea9 T7Cl Firmware C More Ea9 T7Cl R Firmware C More Ea9 T8Cl Firmware C More Ea9 T10Cl Firmware C More Ea9 T10Wcl Firmware C More Ea9 T12Cl Firmware C More Ea9 T15Cl Firmware C More Ea9 T15Cl R Firmware C More Ea9 Rhmi Firmware C More Ea9 Pgmsw Firmware

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Aug 31, 2022 - 16:15 nvd

HIGH 7.8

DescriptionNVD

AutomationDirect DirectLOGIC has a DLL vulnerability in the install directory that may allow an attacker to execute code during the installation process. This issue affects: AutomationDirect C-more EA9 EA9-T6CL versions prior to 6.73; EA9-T6CL-R versions prior to 6.73; EA9-T7CL versions prior to 6.73; EA9-T7CL-R versions prior to 6.73; EA9-T8CL versions prior to 6.73; EA9-T10CL versions prior to 6.73; EA9-T10WCL versions prior to 6.73; EA9-T12CL versions prior to 6.73; EA9-T15CL versions prior to 6.73; EA9-RHMI versions prior to 6.73; EA9-PGMSW versions prior to 6.73;

AnalysisAI

AutomationDirect DirectLOGIC has a DLL vulnerability in the install directory that may allow an attacker to execute code during the installation process. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.

Technical ContextAI

This vulnerability is classified under CWE-427. AutomationDirect DirectLOGIC has a DLL vulnerability in the install directory that may allow an attacker to execute code during the installation process. This issue affects: AutomationDirect C-more EA9 EA9-T6CL versions prior to 6.73; EA9-T6CL-R versions prior to 6.73; EA9-T7CL versions prior to 6.73; EA9-T7CL-R versions prior to 6.73; EA9-T8CL versions prior to 6.73; EA9-T10CL versions prior to 6.73; EA9-T10WCL versions prior to 6.73; EA9-T12CL versions prior to 6.73; EA9-T15CL versions prior to 6.73; EA9-RHMI versions prior to 6.73; EA9-PGMSW versions prior to 6.73; Affected products include: Automationdirect C-More Ea9-T6Cl Firmware, Automationdirect C-More Ea9-T6Cl-R Firmware, Automationdirect C-More Ea9-T7Cl Firmware, Automationdirect C-More Ea9-T7Cl-R Firmware, Automationdirect C-More Ea9-T8Cl Firmware. Version information: prior to 6.73.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.