CVE-2022-29897: Remote Code Execution in all versions of various RAD-ISM-900-EN-* devices by PHOENIX CONTACT
Published May 11, 2022
·Updated
On various RAD-ISM-900-EN- devices by PHOENIX CONTACT an admin user could use the traceroute utility integrated in the WebUI to execute arbitrary code with root privileges on the OS due to an improper input validation in all versions of the firmware.
Affected Software
6 affected components
Phoenixcontact Rad-ism-900-en-bd Firmware
Phoenixcontact Rad-ism-900-en-bd
Phoenixcontact Rad-ism-900-en-bd\/b Firmware
Phoenixcontact Rad-ism-900-en-bd\/b
Phoenixcontact Rad-ism-900-en-bd-bus Firmware
Phoenixcontact Rad-ism-900-en-bd-bus
Event History
May 11, 2022
CVE Published
via MITRE·02:25 PM
Data Sourced
via MITRE·02:25 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2022-29897.
2
What is the severity level of CVE-2022-29897?
CVE-2022-29897 has a severity level of critical (9.1).
3
Which devices are affected by CVE-2022-29897?
Various RAD-ISM-900-EN-* devices by PHOENIX CONTACT are affected by CVE-2022-29897.
4
How can an admin user exploit CVE-2022-29897?
An admin user can exploit CVE-2022-29897 by using the traceroute utility integrated in the WebUI to execute arbitrary code with root privileges on the OS.
5
Is there a fix available for CVE-2022-29897?
Please refer to the vendor's advisory for information on available fixes for CVE-2022-29897.