CVE-2022-28223

Wednesday, March 30, 2022

9.1

CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:H/S:C/UI:N

Summary

Tekon KIO devices through 2022-03-30 allow an authenticated admin user to escalate privileges to root by uploading a malicious Lua plugin.

Affected Software

Vendor	Product	Version Range	Status
n/a	n/a	`n/a`	affected

Weaknesses

n/a

ADP Enrichment

CVE Program Container

Additional References

https://medium.com/%40bertinjoseb/post-auth-rce-based-in-malicious-lua-plugin-script-upload-scada-controllers-located-in-russia-57044425ac38

References

https://medium.com/%40bertinjoseb/post-auth-rce-based-in-malicious-lua-plugin-script-upload-scada-controllers-located-in-russia-57044425ac38

Feedback

Was this page helpful?

Glad to hear it! Please tell us how we can improve.

Sorry to hear that. Please tell us how we can improve.