CVE-2022-45914 Missing authorization in n/a
Attackers can modify electronic shelf label data via unauthenticated RF signals, impacting retail pricing and inventory organization.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-45914?
CVE-2022-45914 is a medium-severity missing authorization vulnerability in n/a, published on 27 Nov 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The ESL (Electronic Shelf Label) protocol, as implemented by (for example) the OV80e934802 RF transceiver on the ETAG-2130-V4.3 20190629 board, does not use authentication, which allows attackers to change label values via 433 MHz RF signals, as demonstrated by disrupting the organization of a hospital storage unit, or changing retail pricing.
Weakness: CWE-294
Which versions are affected by CVE-2022-45914?
It affects 1 product.
Products include Electronic Shelf Label Protocol Project Electronic Shelf Label Protocol.
How do I fix CVE-2022-45914?
No fix has been published for CVE-2022-45914 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2022-45914 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-45914 exists.
Sources
Also known as GHSA-mp8x-36fv-pwv3.