CVE-2022-3685

Summary

A vulnerability exists in the SDM600 software. The software operates at a privilege level that is higher than the minimum level required. An attacker who successfully exploits this vulnerability can escalate privileges.

This issue affects: All SDM600 versions prior to version 1.3.0.

List of CPEs:

  • cpe:2.3:a:hitachienergy:sdm600:1.0:::::::*
  • cpe:2.3:a:hitachienergy:sdm600:1.1:::::::*
  • cpe:2.3:a:hitachienergy:sdm600:1.2:::::::*
  • cpe:2.3:a:hitachienergy:sdm600:1.2.9002.257:::::::*
  • cpe:2.3:a:hitachienergy:sdm600:1.2.10002.257:::::::*
  • cpe:2.3:a:hitachienergy:sdm600:1.2.11002.149:::::::*
  • cpe:2.3:a:hitachienergy:sdm600:1.2.12002.222:::::::*
  • cpe:2.3:a:hitachienergy:sdm600:1.2.13002.72:::::::*
  • cpe:2.3:a:hitachienergy:sdm600:1.2.14002.44:::::::*
  • cpe:2.3:a:hitachienergy:sdm600:1.2.14002.92:::::::*
  • cpe:2.3:a:hitachienergy:sdm600:1.2.14002.108:::::::*
  • cpe:2.3:a:hitachienergy:sdm600:1.2.14002.182:::::::*
  • cpe:2.3:a:hitachienergy:sdm600:1.2.14002.257:::::::*
  • cpe:2.3:a:hitachienergy:sdm600:1.2.14002.342:::::::*
  • cpe:2.3:a:hitachienergy:sdm600:1.2.14002.447:::::::*
  • cpe:2.3:a:hitachienergy:sdm600:1.2.14002.481:::::::*
  • cpe:2.3:a:hitachienergy:sdm600:1.2.14002.506:::::::*
  • cpe:2.3:a:hitachienergy:sdm600:1.2.14002.566:::::::*
  • cpe:2.3:a:hitachienergy:sdm600:1.2.20000.3174:::::::*
  • cpe:2.3:a:hitachienergy:sdm600:1.2.21000.291:::::::*
  • cpe:2.3:a:hitachienergy:sdm600:1.2.21000.931:::::::*
  • cpe:2.3:a:hitachienergy:sdm600:1.2.21000.105:::::::*
  • cpe:2.3:a:hitachienergy:sdm600:1.2.23000.291:::::::*
  • cpe:2.3:a:hitachienergy:sdm600:1.3.0.1339:::::::*

Affected Software

VendorProductVersion RangeStatus
Hitachi EnergySDM600SDM600 1.3affected
Hitachi EnergySDM600SDM600 1.2 <= SDM600 1.2.*affected
Hitachi EnergySDM600SDM600 1.1 <= SDM600 1.1.*affected
Hitachi EnergySDM600SDM600 1.0 <= SDM600 1.0.*affected

Weaknesses

  • CWE-285: CWE-285:Improper Authorization

Workarounds

Apply mitigation as described in the cybersecurity advisory Mitigation Factors/Workarounds Section.

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References