CVE-2022-38124 : Debug tool in Secomea SiteManager allows logged-in administrator to modify syste

Products affected by CVE-2022-38124

Secomea » Sitemanager 1129 Firmware
Versions before (<) 10.0.622425017
cpe:2.3:o:secomea:sitemanager_1129_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Secomea » Sitemanager 1129 » Version: N/A
Secomea » Sitemanager 1139 Firmware
Versions before (<) 10.0.622425017
cpe:2.3:o:secomea:sitemanager_1139_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Secomea » Sitemanager 1139 » Version: N/A
Secomea » Sitemanager 1149 Firmware
Versions before (<) 10.0.622425017
cpe:2.3:o:secomea:sitemanager_1149_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Secomea » Sitemanager 1149 » Version: N/A
Secomea » Sitemanager 3329 Firmware
Versions before (<) 10.0.622425017
cpe:2.3:o:secomea:sitemanager_3329_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Secomea » Sitemanager 3329 » Version: N/A
Secomea » Sitemanager 3339 Firmware
Versions before (<) 10.0.622425017
cpe:2.3:o:secomea:sitemanager_3339_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Secomea » Sitemanager 3339 » Version: N/A
Secomea » Sitemanager 3349 Firmware
Versions before (<) 10.0.622425017
cpe:2.3:o:secomea:sitemanager_3349_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Secomea » Sitemanager 3349 » Version: N/A
Secomea » Sitemanager 3529 Firmware
Versions before (<) 10.0.622425017
cpe:2.3:o:secomea:sitemanager_3529_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Secomea » Sitemanager 3529 » Version: N/A
Secomea » Sitemanager 3539 Firmware
Versions before (<) 10.0.622425017
cpe:2.3:o:secomea:sitemanager_3539_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Secomea » Sitemanager 3539 » Version: N/A
Secomea » Sitemanager 3549 Firmware
Versions before (<) 10.0.622425017
cpe:2.3:o:secomea:sitemanager_3549_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Secomea » Sitemanager 3549 » Version: N/A
Secomea » Sitemanager 1529 Firmware
Versions before (<) 10.0.622425017
cpe:2.3:o:secomea:sitemanager_1529_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Secomea » Sitemanager 1529 » Version: N/A
Secomea » Sitemanager 1539 Firmware
Versions before (<) 10.0.622425017
cpe:2.3:o:secomea:sitemanager_1539_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Secomea » Sitemanager 1539 » Version: N/A
Secomea » Sitemanager 1549 Firmware
Versions before (<) 10.0.622425017
cpe:2.3:o:secomea:sitemanager_1549_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Secomea » Sitemanager 1549 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2022-38124

EPSS FAQ

0.10%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 26 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-38124

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H	1.2	5.2	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: None Integrity: High Availability: High
5.7	MEDIUM	CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H	0.5	5.2	Secomea A/S
Attack Vector: Adjacent Network Attack Complexity: High Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: None Integrity: High Availability: High

CWE ids for CVE-2022-38124

CWE-267 Privilege Defined With Unsafe Actions

A particular privilege, role, capability, or right can be used to perform unsafe actions that were not intended, even when it is assigned to the correct entity.

Assigned by: VulnerabilityReporting@secomea.com (Secondary)
CWE-269 Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2022-38124

https://www.secomea.com/support/cybersecurity-advisory/

Cybersecurity Advisory - Secomea
Vendor Advisory

CVEs referencing this url

Vulnerability Details : CVE-2022-38124

Products affected by CVE-2022-38124

Exploit prediction scoring system (EPSS) score for CVE-2022-38124

CVSS scores for CVE-2022-38124

CWE ids for CVE-2022-38124

References for CVE-2022-38124