CVE-2022-3083 Other in E850 (ZMQ200)
An attacker can cause denial of service on Landis+Gyr E850 smart meters by manipulating session cookies, rendering the web interface inaccessible.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-3083?
CVE-2022-3083 is a low-severity vulnerability in Landis+Gyr E850 (ZMQ200), published on 1 Feb 2023. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
All versions of Landis+Gyr E850 (ZMQ200) are vulnerable to CWE-784: Reliance on Cookies Without Validation and Integrity. The device's web application navigation depends on the value of the session cookie. The web application could become inaccessible for the user if an attacker changes the cookie values.
Which versions are affected by CVE-2022-3083?
It affects 1 product.
Products include Landisgyr E850 Firmware.
How do I fix CVE-2022-3083?
No fix has been published for CVE-2022-3083 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-3083 being exploited?
There is no known exploitation of CVE-2022-3083 in the wild and no public exploit code.
Sources
Also known as GHSA-f3gr-956r-2x26.