CVE-2022-32513 Weak cryptography in C-Bus Network Automation Controller, LSS5500NAC
Weak password requirements allow attackers to brute force credentials and gain control of C-Bus automation controllers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-32513?
CVE-2022-32513 is a critical vulnerability in Schneider Electric C-Bus Network Automation Controller, LSS5500NAC, published on 30 Jan 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A CWE-521: Weak Password Requirements vulnerability exists that could allow an attacker to gain control of the device when the attacker brute forces the password. Affected Products: C-Bus Network Automation Controller - LSS5500NAC (Versions prior to V1.10.0), Wiser for C-Bus Automation Controller - LSS5500SHAC (Versions prior to V1.10.0), Clipsal C-Bus Network Automation Controller - 5500NAC (Versions prior to V1.10.0), Clipsal Wiser for C-Bus Automation Controller - 5500SHAC (Versions prior to V1.10.0), SpaceLogic C-Bus Network Automation Controller - 5500NAC2 (Versions prior to V1.10.0), SpaceLogic C-Bus Application Controller - 5500AC2 (Versions prior to V1.10.0)
Weakness: CWE-521
Which versions are affected by CVE-2022-32513?
It affects 6 products.
Products include Schneider-Electric 5500ac2 Firmware, Schneider-Electric 5500nac2 Firmware, Schneider-Electric 5500nac Firmware, Schneider-Electric 5500shac Firmware, Schneider-Electric Lss5500nac Firmware, Schneider-Electric Lss5500shac Firmware.
How do I fix CVE-2022-32513?
No fix has been published for CVE-2022-32513 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-32513 being exploited?
There is no known exploitation of CVE-2022-32513 in the wild and no public exploit code.
Other vulnerabilities in Schneider Electric C-Bus Network Automation Controller, LSS5500NAC
Sources
Also known as GHSA-g6vq-fv87-p4jp.