CVE-2022-28223

Tekon KIO devices through 2022-03-30 allow an authenticated admin user to escalate privileges to root by uploading a malicious Lua plugin.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.1 CRITICAL
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
mitreCNA
9.1 CRITICAL
NETWORK
LOW
HIGH
CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:H/S:C/UI:N
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 64%
VendorProductVersion
tekonkio_firmware
𝑥
≤ 2022-03-30
tekonkio-1m_firmware
𝑥
≤ 2022-03-30
tekonkio-2mrs_firmware
𝑥
≤ 2022-03-30
tekonkio-2m_firmware
𝑥
≤ 2022-03-30
tekonkio-2ms_firmware
𝑥
≤ 2022-03-30
tekonkio-2md_firmware
𝑥
≤ 2022-03-30
tekonkio-8\(4\)_firmware
𝑥
≤ 2022-03-30
tekonkio-8\(4\)l_firmware
𝑥
≤ 2022-03-30
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://medium.com/%40bertinjoseb/post-auth-rce-based-in-malicious-lua-plugin-script-upload-scada-controllers-located-in-russia-57044425ac38
https://medium.com/%40bertinjoseb/post-auth-rce-based-in-malicious-lua-plugin-script-upload-scada-controllers-located-in-russia-57044425ac38