High severity · published Jun 24, 2022
CVE-2022-1746
2.2.8 INCORRECT PRIVILEGE ASSIGNMENT CWE-266
7.6
CVSS
0.3%
EPSS
No
On KEV
Description
The authentication mechanism used by poll workers to administer voting using the tested version of Dominion Voting Systems ImageCast X can expose cryptographic secrets used to protect election information. An attacker could leverage this vulnerability to gain access to sensitive information and perform privileged actions, potentially affecting other election equipment.
CVSS vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack vector
Physical
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IX
ImageCast X application · Dominion Voting Systems
Version 5.5-A Versions 5.5.10.30 and 5.5.10.32 · source: vendor
IX
ImageCast X firmware · Dominion Voting Systems
Version 5.5-A · source: vendor
IX
Imagecast X · Dominionvoting
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-1746
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-1746
Mitigation
https://www.cisa.gov/uscert/ics/advisories/icsa-22-154-01
More from ImageCast X application
6.8
CVE-2022-1745
2.2.7 AUTHENTICATION BYPASS BY SPOOFING CWE-290
6.8
CVE-2022-1742
2.2.4 IMPROPER PROTECTION OF ALTERNATE PATH CWE-424
6.8
CVE-2022-1741
2.2.3 HIDDEN FUNCTIONALITY CWE-912
6.8
CVE-2022-1739
2.2.1 IMPROPER VERIFICATION OF CRYPTOGRAPHIC SIGNATURE CWE-347
4.6
CVE-2022-1740
2.2.2 MUTABLE ATTESTATION OR MEASUREMENT REPORTING DATA CWE-1283
