CVE-2022-30237

EUVD-2022-35443 · Published Jun 2, 2022

A CWE-311: Missing Encryption of Sensitive Data vulnerability exists that could allow authentication credentials to be recovered when an attacker breaks the encoding. Affected Products: Wiser Smart, EER21000 & EER21001 (V4.5 and prior)

Technologies

Schneider-Electric Wiser Smart Eer21001 FirmwareSchneider-Electric Wiser Smart Eer21000 FirmwareSchneider-Electric Wiser Smart Eer21000Schneider-Electric Wiser Smart Eer21001

Weaknesses

CWE-311

CVSS scores

v3.17.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
v2.05.0AV:N/AC:L/Au:N/C:P/I:N/A:N

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Initial Access Credential Access Discovery Collection

T1190Exploit Public-Facing Application T1005Data from Local System T1040Network Sniffing T1056.004Credential API Hooking T1111Multi-Factor Authentication Interception T1539Steal Web Session Cookie T1552.004Private Keys

References

https://www.se.com/ww/en/download/document/SEVD-2022-130-03/

Potentially impacted assets

See if this affects your attack surface