CVE-2022-37300

CRITICAL Year: 2022
CVSS v3 Score
9.8
Critical
Weakness Type
CWE-640
View all →

Vulnerability Description

A CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability exists that could cause unauthorized access in read and write mode to the controller when communicating over Modbus. Affected Products: EcoStruxure Control Expert Including all Unity Pro versions (former name of EcoStruxure Control Expert) (V15.0 SP1 and prior), EcoStruxure Process Expert, Including all versions of EcoStruxure Hybrid DCS (former name of EcoStruxure Process Expert) (V2021 and prior), Modicon M340 CPU (part numbers BMXP34*) (V3.40 and prior), Modicon M580 CPU (part numbers BMEP* and BMEH*) (V3.20 and prior).

Related Vulnerabilities

CVE-2012-5618

CRITICAL
CVSS:9.8(Critical)

Ushahidi before 2.6.1 has insufficient entropy for forgot-password tokens.

CWE-6402012

CVE-2012-5686

CRITICAL
CVSS:9.8(Critical)

ZPanel 10.0.1 has insufficient entropy for its password reset process.

CWE-6402012

CVE-2015-4689

CRITICAL
CVSS:9.8(Critical)

Ellucian (formerly SunGard) Banner Student 8.5.1.2 through 8.7 allows remote attackers to reset arbitrary passwords via unspecified vectors, aka "Weak Password Reset."

CWE-6402015

CVE-2015-5172

CRITICAL
CVSS:9.8(Critical)

Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers to have unspecified impact by leveraging failure to expire p...

CWE-6402015

CVE-2017-17097

CRITICAL
CVSS:9.8(Critical)

gps-server.net GPS Tracking Software (self hosted) 2.x has a password reset procedure that immediately resets passwords upon an unauthenticated request, and then sends e-mail with a predictable (date-...

CWE-6402017

CVE-2017-2766

CRITICAL
CVSS:9.8(Critical)

EMC Documentum eRoom version 7.4.4, EMC Documentum eRoom version 7.4.4 SP1, EMC Documentum eRoom version prior to 7.4.5 P04, EMC Documentum eRoom version prior to 7.5.0 P01 includes an unverified pass...

CWE-6402017