CVE-2022-29518

Severity Score

7.0

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Screen Creator Advance2, HMI GC-A2 series, and Real time remote monitoring and control tool Screen Creator Advance2 versions prior to Ver.0.1.1.3 Build01, HMI GC-A2 series(GC-A22W-CW, GC-A24W-C(W), GC-A26W-C(W), GC-A24, GC-A24-M, GC-A25, GC-A26, and GC-A26-J2), and Real time remote monitoring and control tool(Remote GC) allows a local attacker to bypass authentication due to the improper check for the Remote control setting's account names. This may allow attacker who can access the HMI from Real time remote monitoring and control tool may perform arbitrary operations on the HMI. As a result, the information stored in the HMI may be disclosed, deleted or altered, and/or the equipment may be illegally operated via the HMI.

Screen Creator Advance2, la serie HMI GC-A2 y la herramienta de control y supervisión remota en tiempo real Screen Creator Advance2 versiones anteriores a 0.1.1.3 Build01, la serie HMI GC-A2(GC-A22W-CW, GC-A24W-C(W), GC-A26W-C(W), GC-A24, GC-A24-M, GC-A25, GC-A26, y GC-A26-J2), y la herramienta de monitorización y control remoto en tiempo real(Remote GC) permiten a un atacante local omitir la autenticación debido a la comprobación inapropiada de los nombres de cuenta de la configuración del control remoto. Esto puede permitir que un atacante que pueda acceder a la HMI desde la herramienta de control y supervisión remota en tiempo real pueda llevar a cabo operaciones arbitrarias en la HMI. Como resultado, la información almacenada en la HMI puede ser divulgada, borrada o alterada, y/o el equipo puede ser operado ilegalmente por medio de la HMI

*Credits: N/A

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Local

Attack Complexity

Medium

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2022-04-28 CVE Reserved
2022-05-18 CVE Published
2023-03-08 EPSS Updated
2024-08-03 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CAPEC

References (2)

URL	Tag	Source
https://jvn.jp/en/jp/JVN50337155/index.html	Third Party Advisory

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://www.koyoele.co.jp/en/topics/202205095016	2023-08-08

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Koyoele Search vendor "Koyoele"	Gc-a22w-cw Firmware Search vendor "Koyoele" for product "Gc-a22w-cw Firmware"	-	-	Affected	in	Koyoele Search vendor "Koyoele"	Gc-a22w-cw Search vendor "Koyoele" for product "Gc-a22w-cw"	-	-	Safe
Koyoele Search vendor "Koyoele"	Gc-a24 Firmware Search vendor "Koyoele" for product "Gc-a24 Firmware"	-	-	Affected	in	Koyoele Search vendor "Koyoele"	Gc-a24 Search vendor "Koyoele" for product "Gc-a24"	-	-	Safe
Koyoele Search vendor "Koyoele"	Gc-a24-m Firmware Search vendor "Koyoele" for product "Gc-a24-m Firmware"	-	-	Affected	in	Koyoele Search vendor "Koyoele"	Gc-a24-m Search vendor "Koyoele" for product "Gc-a24-m"	-	-	Safe
Koyoele Search vendor "Koyoele"	Gc-a24w-c\(w\) Firmware Search vendor "Koyoele" for product "Gc-a24w-c\(w\) Firmware"	-	-	Affected	in	Koyoele Search vendor "Koyoele"	Gc-a24w-c\(w\) Search vendor "Koyoele" for product "Gc-a24w-c\(w\)"	-	-	Safe
Koyoele Search vendor "Koyoele"	Gc-a25 Firmware Search vendor "Koyoele" for product "Gc-a25 Firmware"	-	-	Affected	in	Koyoele Search vendor "Koyoele"	Gc-a25 Search vendor "Koyoele" for product "Gc-a25"	-	-	Safe
Koyoele Search vendor "Koyoele"	Gc-a26 Firmware Search vendor "Koyoele" for product "Gc-a26 Firmware"	-	-	Affected	in	Koyoele Search vendor "Koyoele"	Gc-a26 Search vendor "Koyoele" for product "Gc-a26"	-	-	Safe
Koyoele Search vendor "Koyoele"	Gc-a26-j2 Firmware Search vendor "Koyoele" for product "Gc-a26-j2 Firmware"	-	-	Affected	in	Koyoele Search vendor "Koyoele"	Gc-a26-j2 Search vendor "Koyoele" for product "Gc-a26-j2"	-	-	Safe
Koyoele Search vendor "Koyoele"	Gc-a26w-c\(w\) Firmware Search vendor "Koyoele" for product "Gc-a26w-c\(w\) Firmware"	-	-	Affected	in	Koyoele Search vendor "Koyoele"	Gc-a26w-c\(w\) Search vendor "Koyoele" for product "Gc-a26w-c\(w\)"	-	-	Safe
Koyoele Search vendor "Koyoele"		Remote Gc Search vendor "Koyoele" for product "Remote Gc"				-		-		Affected
Koyoele Search vendor "Koyoele"		Screen Creator Advance 2 Search vendor "Koyoele" for product "Screen Creator Advance 2"				< 0.1.1.3 Search vendor "Koyoele" for product "Screen Creator Advance 2" and version " < 0.1.1.3"		-		Affected
Koyoele Search vendor "Koyoele"		Screen Creator Advance 2 Search vendor "Koyoele" for product "Screen Creator Advance 2"				0.1.1.3 Search vendor "Koyoele" for product "Screen Creator Advance 2" and version "0.1.1.3"		-		Affected