CVE-2022-3976: MZ Automation libiec61850 MMS File Services mms_client_files.c path traversal
A vulnerability has been found in MZ Automation libiec61850 up to 1.4 and classified as critical. This vulnerability affects unknown code of the file src/mms/isomms/client/mmsclientfiles.c of the component MMS File Services. The manipulation of the argument filename leads to path traversal. Upgrading to version 1.5 is able to address this issue. The name of the patch is 10622ba36bb3910c151348f1569f039ecdd8786f. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-213556.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MZ Automation libiec61850 (MMS File Services)to a version that resolves this vulnerability.Fixed in 1.5Patch 10622ba36bb3910c151348f1569f039ecdd8786f - Compensating control
If immediate upgrade is not possible, restrict external access to the MMS File Services component/endpoint that uses src/mms/iso_mms/client/mms_client_files.c to reduce exposure to the filename path traversal argument.
Event History
Frequently Asked Questions
What is the severity of CVE-2022-3976?
CVE-2022-3976 has been classified as critical.
How do I fix CVE-2022-3976?
To remediate CVE-2022-3976, upgrade MZ Automation libiec61850 to version 1.5 or later.
What components are affected by CVE-2022-3976?
CVE-2022-3976 affects the MMS File Services component in the libiec61850 library.
What type of vulnerability is CVE-2022-3976?
CVE-2022-3976 is a path traversal vulnerability.
Which versions of libiec61850 are vulnerable to CVE-2022-3976?
Versions of MZ Automation libiec61850 up to and including 1.4 are vulnerable to CVE-2022-3976.