CVE-2022-29898: Remote Code Execution in all versions of various RAD-ISM-900-EN-* devices by PHOENIX CONTACT
First published: Wed May 11 2022(Updated: )
On various RAD-ISM-900-EN-* devices by PHOENIX CONTACT an admin user could use the configuration file uploader in the WebUI to execute arbitrary code with root privileges on the OS due to an improper validation of an integrity check value in all versions of the firmware.
Credit: info@cert.vde.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Phoenixcontact Rad-ism-900-en-bd Firmware | ||
| Phoenixcontact Rad-ism-900-en-bd | ||
| Phoenixcontact Rad-ism-900-en-bd\/b Firmware | ||
| Phoenixcontact Rad-ism-900-en-bd\/b | ||
| Phoenixcontact Rad-ism-900-en-bd-bus Firmware | ||
| Phoenixcontact Rad-ism-900-en-bd-bus |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2022-29898.
What devices are affected by this vulnerability?
Various RAD-ISM-900-EN-* devices by PHOENIX CONTACT are affected by this vulnerability.
What is the severity of CVE-2022-29898?
The severity of CVE-2022-29898 is critical with a CVSS score of 9.1.
How can an admin user exploit this vulnerability?
An admin user can exploit this vulnerability by using the configuration file uploader in the WebUI to execute arbitrary code with root privileges on the OS.
Is there a fix available for this vulnerability?
Please refer to the advisory by VDE CERT for information on available fixes and mitigations: https://cert.vde.com/en/advisories/VDE-2022-018/
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/title
- agent/author
- agent/severity
- agent/weakness
- agent/references
- agent/description
- agent/first-publish-date
- agent/tags
- agent/event
- vendor/phoenixcontact
- canonical/phoenixcontact rad-ism-900-en-bd firmware
- canonical/phoenixcontact rad-ism-900-en-bd
- canonical/phoenixcontact rad-ism-900-en-bd\/b firmware
- canonical/phoenixcontact rad-ism-900-en-bd\/b
- canonical/phoenixcontact rad-ism-900-en-bd-bus firmware
- canonical/phoenixcontact rad-ism-900-en-bd-bus