CVE-2022-45444

Summary

Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 contains hard-coded passwords for select users in the application’s database. This could allow a remote attacker to login to the database with unrestricted access.

Affected Software

Weaknesses

• CWE-259: CWE-259 Use of Hard-coded Password

Workarounds

Sewio also recommends the following workarounds to reduce the risk of exploitation:

• Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01 .

  • Locate control system networks and remote devices behind firewalls and isolate them from business networks.

  • Manually change the database password.  

ADP Enrichment

CVE Program Container

Additional References

• https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-01

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: yes
  • Technical Impact: total

References

• https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-01

• ←Previous
• Next→