CVE-2022-40187

CVSS V2 None CVSS V3 High 8

Description

Foresight GC3 Launch Monitor 1.3.15.68 ships with a Target Communication Framework (TCF) service enabled. This service listens on a TCP port on all interfaces and allows for process debugging, file system modification, and terminal access as the root user. In conjunction with a hosted wireless access point and the known passphrase of FSSPORTS, an attacker could use this service to modify a device and steal intellectual property.

Overview

CVE ID
CVE-2022-40187

Assigner
cve@mitre.org

Vulnerability Status
Analyzed

Published Version
2022-10-13T01:15:19

Last Modified Date
2022-10-14T19:59:36

Weakness Enumerations

CWE	URL
CWE-276	http://cwe.mitre.org/data/definitions/276.html

CPE Configuration (Product)

CPE	Vulnerable	Operator	Version End
		AND
cpe:2.3:o:foresightsports:gc3_launch_monitor_firmware::::::::	1	OR	1.5.0.2
cpe:2.3:h:foresightsports:gc3_launch_monitor:-:::::::*	0	OR
		AND
cpe:2.3:o:bushnellgolf:launch_pro_firmware::::::::	1	OR	1.5.0.2
cpe:2.3:h:bushnellgolf:launch_pro:-:::::::*	0	OR

CVSS Version 3

Version
3.1

Vector String
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
ADJACENT_NETWORK

Attack Compatibility
LOW

Privileges Required
LOW

User Interaction
NONE

Scope
UNCHANGED

Confidentiality Impact
HIGH

Availability Impact
HIGH

Base Score
8

Base Severity
HIGH

Exploitability Score
2.1

Impact Score
5.9

References

Reference URL	Reference Tags
https://www.foresightsports.com/gc3
https://www.bushnellgolf.com/products/launch-monitors/launch-pro/
https://wiki.eclipse.org/TCF
https://github.com/atredispartners/advisories/blob/master/ATREDIS-2022-0003.md

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2022-40187
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40187

History

Created	Old Value	New Value	Data Type	Notes
2022-10-13 02:00:10				Added to TrackCVE
2022-12-07 06:58:21	2022-10-13T01:15Z	2022-10-13T01:15:19	CVE Published Date	updated
2022-12-07 06:58:21		2022-10-14T19:59:36	CVE Modified Date	updated
2022-12-07 06:58:21		Analyzed	Vulnerability Status	updated