What is the CVSS score of CVE-2022-45937?

CVE-2022-45937 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.6%.

Is there a patch available for CVE-2022-45937?

Yes, a patch is available for CVE-2022-45937. Update the affected software to the latest version immediately.

Pxc00 E96 A Firmware CVE-2022-45937

MEDIUM

Improper Access Control (CWE-284)

2022-12-13 productcert@siemens.com

Authentication Bypass Pxc00 E96 A Firmware Pxc100 E96 A Firmware Pxx 485 3 Firmware Pxc16 2 Pe A Firmware Pxc24 2 Pe A Firmware Pxc24 2 Pef A Firmware Pxc24 2 Per A Firmware Pxc24 2 Perf A Firmware Talon Tc Modular Bacnet Firmware

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Dec 13, 2022 - 16:15 nvd

MEDIUM 6.5

DescriptionNVD

A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.20), APOGEE PXC Modular (BACnet) (All versions < V3.5.5), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.20), TALON TC Compact (BACnet) (All versions < V3.5.5), TALON TC Modular (BACnet) (All versions < V3.5.5). A low privilege authenticated attacker with network access to the integrated web server could download sensitive information from the device containing user account credentials.

AnalysisAI

Technical ContextAI

This vulnerability is classified under CWE-284. A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.20), APOGEE PXC Modular (BACnet) (All versions < V3.5.5), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.20), TALON TC Compact (BACnet) (All versions < V3.5.5), TALON TC Modular (BACnet) (All versions < V3.5.5). A low privilege authenticated attacker with network access to the integrated web server could download sensitive information from the device containing user account credentials. Affected products include: Siemens Pxc00-E96.A Firmware, Siemens Pxc100-E96.A Firmware, Siemens Pxx-485.3 Firmware, Siemens Pxc16.2-Pe.A Firmware, Siemens Pxc24.2-Pe.A Firmware.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.