CVE-2022-41648 - Vulnerability Details - OpenCVE

The HEIDENHAIN Controller TNC 640, version 340590 07 SP5, running HEROS 5.08.3 controlling the HARTFORD 5A-65E CNC machine is vulnerable to improper authentication, which may allow an attacker to deny service to the production line, steal sensitive data from the production line, and alter any products created by the production line.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Heidenhain	Heros Tnc 640 Tnc 640 Programming Station

Configuration 1 [-]

AND

OR	cpe:2.3:a:heidenhain:tnc_640_programming_station:340590_07:sp5::::::
	cpe:2.3:o:heidenhain:heros:5.08.3:::::::*

cpe:2.3:h:heidenhain:tnc_640:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://www.cisa.gov/uscert/ics/advisories/icsa-22-298-02

History

No history.

MITRE

Status: PUBLISHED

Assigner: icscert

Published: 2022-10-28T17:09:41.162581Z

Updated: 2024-09-16T23:51:54.049Z

Reserved: 2022-09-29T00:00:00

Link: CVE-2022-41648

Vulnrichment

No data.

NVD

Status : Modified

Published: 2022-10-28T18:15:12.723

Modified: 2024-11-21T07:23:33.673

Link: CVE-2022-41648

Redhat

No data.

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:heidenhain:tnc_640_programming_station:340590_07:sp5:*:*:*:*:*:*", "matchCriteriaId": "A4AA5300-77D8-4501-8B6A-FCC96ECE82B7", "vulnerable": true}, {"criteria": "cpe:2.3:o:heidenhain:heros:5.08.3:*:*:*:*:*:*:*", "matchCriteriaId": "C75C780C-A5AE-4D32-9D27-461DBA78B7B2", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:heidenhain:tnc_640:-:*:*:*:*:*:*:*", "matchCriteriaId": "1F5BAD18-3699-43C9-B6D9-FBF6C237CF2C", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "The HEIDENHAIN Controller TNC 640, version 340590 07 SP5, running HEROS 5.08.3 controlling the HARTFORD 5A-65E CNC machine is vulnerable to improper authentication, which may allow an attacker to deny service to the production line, steal sensitive data from the production line, and alter any products created by the production line."}, {"lang": "es", "value": "HEIDENHAIN Controller TNC 640, versi\u00f3n 340590 07 SP5, que ejecuta HEROS 5.08.3 y controla la m\u00e1quina HARTFORD 5A-65E CNC, es vulnerable a una autenticaci\u00f3n incorrecta, lo que puede permitir a un atacante negar el servicio a la l\u00ednea de producci\u00f3n y robar datos sensibles de la l\u00ednea de producci\u00f3n y alterar cualquier producto creado por la l\u00ednea de producci\u00f3n."}], "id": "CVE-2022-41648", "lastModified": "2024-11-21T07:23:33.673", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-10-28T18:15:12.723", "references": [{"source": "ics-cert@hq.dhs.gov", "tags": ["Mitigation", "Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-298-02"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mitigation", "Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-298-02"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-287"}], "source": "nvd@nist.gov", "type": "Primary"}]}