CVE-2022-3090

HIGH

Red Lion Controls Crimson <3.0-3.2.0044.0 - Path Traversal

Title source: llm

Description

Red Lion Controls Crimson 3.0 versions 707.000 and prior, Crimson 3.1 versions 3126.001 and prior, and Crimson 3.2 versions 3.2.0044.0 and prior are vulnerable to path traversal. When attempting to open a file using a specific path, the user's password hash is sent to an arbitrary host. This could allow an attacker to obtain user credential hashes.

References (1)

Core 1

Core References

Third Party Advisory, US Government Resource

https://www.cisa.gov/uscert/ics/advisories/icsa-22-321-01

Scores

CVSS v3 7.5

EPSS 0.0061

EPSS Percentile 44.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-22

Status published

Products (1)

redlion/crimson 3.0 (50 CPE variants)

Published Nov 17, 2022

Tracked Since Feb 18, 2026