CVE-2022-3976 MZ Automation libiec61850 MMS File Services mms_client_files.c path traversal

What is CVE-2022-3976?

CVE-2022-3976 is a medium-severity vulnerability in MZ Automation libiec61850, published on 13 Nov 2022.

Official description

A vulnerability has been found in MZ Automation libiec61850 up to 1.4 and classified as critical. This vulnerability affects unknown code of the file src/mms/iso_mms/client/mms_client_files.c of the component MMS File Services. The manipulation of the argument filename leads to path traversal. Upgrading to version 1.5 is able to address this issue. The name of the patch is 10622ba36bb3910c151348f1569f039ecdd8786f. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-213556.

Weakness: CWE-22

Which versions are affected by CVE-2022-3976?

It affects 1 product.

Products include Mz-Automation Libiec61850.

How do I fix CVE-2022-3976?

No fix has been published for CVE-2022-3976 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-3976 being exploited?

There is no known exploitation of CVE-2022-3976 in the wild and no public exploit code.

Other vulnerabilities in MZ Automation libiec61850

• CVE-2022-2970 MZ Automation libIEC61850 Stack-Based Buffer Overflow Critical 10.0
• CVE-2022-2972 MZ Automation libIEC61850 Stack-Based Buffer Overflow Critical 10.0
• CVE-2024-45970 Memory corruption in n/a Critical 9.8
• CVE-2024-45971 Memory corruption in n/a Critical 9.8
• CVE-2018-19185 Memory corruption in n/a Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-r8h4-q53x-8w2p.