Skip to main content

Cms8000 Firmware CVE-2022-38453

MEDIUM
Active Debug Code (CWE-489)
2022-09-13 ics-cert@hq.dhs.gov
Information Disclosure Cms8000 Firmware
4.4
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
4.4 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

1
CVE Published
Sep 13, 2022 - 15:15 nvd
MEDIUM 4.4

DescriptionNVD

Multiple binary application files on the CMS8000 device are compiled with 'not stripped' and 'debug_info' compilation settings. These compiler settings greatly decrease the level of effort for a threat actor to reverse engineer sensitive code and identify additional vulnerabilities.

AnalysisAI

Multiple binary application files on the CMS8000 device are compiled with 'not stripped' and 'debug_info' compilation settings. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-489. Multiple binary application files on the CMS8000 device are compiled with 'not stripped' and 'debug_info' compilation settings. These compiler settings greatly decrease the level of effort for a threat actor to reverse engineer sensitive code and identify additional vulnerabilities. Affected products include: Contechealth Cms8000 Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Cms8000 Firmware

View all
CVE-2022-38100 HIGH
7.5 Sep 13

The CMS800 device fails while attempting to parse malformed network data sent by a threat actor. Rated high severity (CV
CVE-2022-36385 MEDIUM
6.8 Sep 13

A threat actor with momentary access to the device can plug in a USB drive and perform a malicious firmware update, resu
CVE-2022-38069 MEDIUM
6.1 Sep 13

Multiple globally default credentials exist across all CMS8000 devices, that once exposed, allow a threat actor with mom
CVE-2022-3027 MEDIUM
5.7 Sep 13

The CMS8000 device does not properly control or sanitize the SSID name of a new Wi-Fi access point. Rated medium severit

Same weakness CWE-489 – Active Debug Code

View all
CVE-2017-5259 HIGH POC
8.8
CVE-2024-9643 CRITICAL POC
9.8
CVE-2024-21785 CRITICAL POC
9.8
CVE-2022-29520 CRITICAL POC
9.8
CVE-2022-32585 CRITICAL POC
9.8
CVE-2022-30543 HIGH POC
8.8
CVE-2022-25995 HIGH POC
8.8
CVE-2020-5763 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2022-38453 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy