CVE-2022-32514 Auth bypass in C-Bus Network Automation Controller, LSS5500NAC
Improper authentication in C-Bus Automation Controllers allows attackers to gain device control via web login, requiring firmware upgrades.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-32514?
CVE-2022-32514 is a critical authentication bypass vulnerability in Schneider Electric C-Bus Network Automation Controller, LSS5500NAC, published on 30 Jan 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A CWE-287: Improper Authentication vulnerability exists that could allow an attacker to gain control of the device when logging into a web page. Affected Products: C-Bus Network Automation Controller - LSS5500NAC (Versions prior to V1.10.0), Wiser for C-Bus Automation Controller - LSS5500SHAC (Versions prior to V1.10.0), Clipsal C-Bus Network Automation Controller - 5500NAC (Versions prior to V1.10.0), Clipsal Wiser for C-Bus Automation Controller - 5500SHAC (Versions prior to V1.10.0), SpaceLogic C-Bus Network Automation Controller - 5500NAC2 (Versions prior to V1.10.0), SpaceLogic C-Bus Application Controller - 5500AC2 (Versions prior to V1.10.0)
Weakness: CWE-287
Which versions are affected by CVE-2022-32514?
It affects 6 products.
Products include Schneider-Electric 5500ac2 Firmware, Schneider-Electric 5500nac2 Firmware, Schneider-Electric 5500nac Firmware, Schneider-Electric 5500shac Firmware, Schneider-Electric Lss5500nac Firmware, Schneider-Electric Lss5500shac Firmware.
How do I fix CVE-2022-32514?
No fix has been published for CVE-2022-32514 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2022-32514 being exploited?
There is no known exploitation of CVE-2022-32514 in the wild and no public exploit code.
Other vulnerabilities in Schneider Electric C-Bus Network Automation Controller, LSS5500NAC
Sources
Also known as GHSA-pg33-hcmh-pwwq.