What is the CVSS score of CVE-2022-46832?

CVE-2022-46832 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Rfu620 10100 Firmware CVE-2022-46832

MEDIUM

Use of a Broken or Risky Cryptographic Algorithm (CWE-327)

2022-12-13 psirt@sick.de

Information Disclosure Rfu620 10100 Firmware Rfu620 10101 Firmware Rfu620 10102 Firmware Rfu620 10103 Firmware Rfu620 10104 Firmware Rfu620 10105 Firmware Rfu620 10107 Firmware Rfu620 10108 Firmware Rfu620 10111 Firmware Rfu620 10114 Firmware Rfu620 10118 Firmware Rfu620 10400 Firmware Rfu620 10401 Firmware Rfu620 10500 Firmware Rfu620 10501 Firmware Rfu620 10503 Firmware Rfu620 10504 Firmware Rfu620 10507 Firmware Rfu620 10508 Firmware Rfu620 10510 Firmware Rfu620 10514 Firmware

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Dec 13, 2022 - 16:15 nvd

MEDIUM 6.5

DescriptionNVD

Use of a Broken or Risky Cryptographic Algorithm in SICK RFU62x firmware version < 2.21 allows a low-privileged remote attacker to decrypt the encrypted data if the user requested weak cipher suites to be used for encryption via the SSH interface. The patch and installation procedure for the firmware update is available from the responsible SICK customer contact person.

AnalysisAI

Use of a Broken or Risky Cryptographic Algorithm in SICK RFU62x firmware version < 2.21 allows a low-privileged remote attacker to decrypt the encrypted data if the user requested weak cipher suites. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-327. Use of a Broken or Risky Cryptographic Algorithm in SICK RFU62x firmware version < 2.21 allows a low-privileged remote attacker to decrypt the encrypted data if the user requested weak cipher suites to be used for encryption via the SSH interface. The patch and installation procedure for the firmware update is available from the responsible SICK customer contact person. Affected products include: Sick Rfu620-10100 Firmware, Sick Rfu620-10101 Firmware, Sick Rfu620-10102 Firmware, Sick Rfu620-10103 Firmware, Sick Rfu620-10104 Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.