← Back

CVE-2022-29898

nvd nist
Published: May 11, 2022Modified: Jun 17, 2026

JSON object

Loading...
9.1
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Exploitability: 2.3 / Impact: 6.0
Source: info@cert.vde.com (Secondary)

Description

On various RAD-ISM-900-EN-* devices by PHOENIX CONTACT an admin user could use the configuration file uploader in the WebUI to execute arbitrary code with root privileges on the OS due to an improper validation of an integrity check value in all versions of the firmware.

Affected (3)

Phoenixcontact
3 products
Rad Ism 900 En Bd Firmware
Rad Ism 900 En Bd/b Firmware
Rad Ism 900 En Bd Bus Firmware
Configuration A
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Rad Ism 900 En Bd Firmware
All versions
Running on/withPlatform Versions
Phoenixcontact
Rad Ism 900 En Bd
All versions
Configuration B
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Rad Ism 900 En Bd/b Firmware
All versions
Running on/withPlatform Versions
Phoenixcontact
Rad Ism 900 En Bd/b
All versions
Configuration C
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Rad Ism 900 En Bd Bus Firmware
All versions
Running on/withPlatform Versions
Phoenixcontact
Rad Ism 900 En Bd Bus
All versions

Related CWEs

CWE-354
Improper Validation of Integrity Check Value
The product does not validate or incorrectly validates the integrity check values or "checksums" of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission.

References (2)

Source: info@cert.vde.com
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory

Timeline

No history available yet.