CVE-2022-25922 ICSA-22-063-01 Missing Authentication for Critical Function in Trailer Power Line Communications (PLC) J2497
Attackers can invoke critical diagnostic functions on PLC4TRUCKS trailer brake controllers by replaying messages without authentication.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-25922?
CVE-2022-25922 is a medium-severity missing authorization vulnerability in Power Line Communications PLC4TRUCKS, published on 7 Mar 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Power Line Communications PLC4TRUCKS J2497 trailer brake controllers implement diagnostic functions which can be invoked by replaying J2497 messages. There is no authentication or authorization for these functions.
Weakness: CWE-306
Which versions are affected by CVE-2022-25922?
It affects 1 product.
Products include Hegemonelectronics Plc4trucks Firmware.
How do I fix CVE-2022-25922?
No fix has been published for CVE-2022-25922 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2022-25922 being exploited?
There is no known exploitation of CVE-2022-25922 in the wild and no public exploit code.
Other vulnerabilities in Power Line Communications PLC4TRUCKS
Sources
Also known as GHSA-6rhm-r8wq-wgm6.