CVE-2022-2893

HIGH

RONDS EPM 1.19.5 - Path Traversal via Filename Parameter

Title source: llm
STIX 2.1

Description

RONDS EPM version 1.19.5 does not properly validate the filename parameter, which could allow an unauthorized user to specify file paths and download files.  

References (1)

Core 1
Core References
Third Party Advisory, US Government Resource
https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-02

Scores

CVSS v3 8.2
EPSS 0.0070
EPSS Percentile 48.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-22
Status published
Products (1)
ronds/equipment_predictive_maintenance 1.19.5
Published Jan 17, 2023
Tracked Since Feb 18, 2026