High severity · published Jan 22, 2024
CVE-2022-45792
Project files may contain malicious contents which the software will use to create files on the filesystem
7.8
CVSS
0.3%
EPSS
No
On KEV
Description
Project files may contain malicious contents which the software will use to create files on the filesystem. This allows directory traversal and overwriting files with the privileges of the logged-in user.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SS
Sysmac Studio · Omron
before 1.54.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-45792
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-45792
Third Party Advisory
https://www.dragos.com/advisory/omron-plc-and-engineering-software-network-and-file-format-access/
More from Sysmac Studio
8.1
CVE-2022-34151
Use of hard-coded credentials vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machine automation controller NX7 series all models…
8.1
CVE-2022-33208
Authentication bypass by capture-replay vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machine automation controller NX7 series all…