CVE-2022-4636

CVSS V2 None CVSS V3 None
Description
Black Box KVM Firmware version 3.4.31307 on models ACR1000A-R-R2, ACR1000A-T-R2, ACR1002A-T, ACR1002A-R, and ACR1020A-T is vulnerable to path traversal, which may allow an attacker to steal user credentials and other sensitive information through local file inclusion.
Overview
  • CVE ID
  • CVE-2022-4636
  • Assigner
  • ics-cert@hq.dhs.gov
  • Vulnerability Status
  • Analyzed
  • Published Version
  • 2023-01-10T20:15:10
  • Last Modified Date
  • 2023-01-17T14:08:54
Weakness Enumerations
CWE URL
CWE-22 http://cwe.mitre.org/data/definitions/22.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
AND
cpe:2.3:o:blackbox:acr1000a-r-r2_firmware:3.4.31307:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:blackbox:acr1000a-r-r2:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:blackbox:acr1000a-t-r2_firmware:3.4.31307:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:blackbox:acr1000a-t-r2:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:blackbox:acr1002a-r_firmware:3.4.31307:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:blackbox:acr1002a-r:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:blackbox:acr1002a-t_firmware:3.4.31307:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:blackbox:acr1002a-t:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:blackbox:acr1020a-t_firmware:3.4.31307:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:blackbox:acr1020a-t:-:*:*:*:*:*:*:* 0 OR
References
Reference URL Reference Tags
https://www.cisa.gov/uscert/ics/advisories/icsa-23-010-01
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2022-4636
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4636
History
Created Old Value New Value Data Type Notes
2023-01-10 21:18:28 Added to TrackCVE
2023-01-10 21:18:29 Weakness Enumeration new
2023-01-12 05:16:35 2023-01-11T15:09:58 CVE Modified Date updated
2023-01-12 05:16:35 Received Awaiting Analysis Vulnerability Status updated
2023-01-12 21:14:58 Awaiting Analysis Undergoing Analysis Vulnerability Status updated
2023-01-17 14:14:32 2023-01-17T14:08:54 CVE Modified Date updated
2023-01-17 14:14:32 Undergoing Analysis Analyzed Vulnerability Status updated
2023-01-17 14:14:33 CPE Information updated