CVE-2022-38130: keysight sensor_management

Record summary

CVE-2022-38130 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

The com.keysight.tentacle.config.ResourceManager.smsRestoreDatabaseZip() method is used to restore the HSQLDB database used in SMS. It takes the path of the zipped database file as the single parameter. An unauthenticated, remote attacker can specify an UNC path for the database file (i.e., \\<attacker-host>\sms\<attacker-db.zip>), effectively controlling the content of the database to be restored.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV: Listed · Nov 18, 2023 · VulnCheck
Reported exploitation: Observed · VulnCheck

Available material

Nuclei templates: 1

Affected products and versions

Product	Source	Version range	Status
sensor_management_server Browse keysight / sensor_management_server	VulnCheck	Version data not supplied
Keysight Technologies Sensor Management Server	CVE List	Keysight Technologies Sensor Management Server v2.4.0	affected

Nuclei templates

ProjectDiscoveryCRITICALKeySight RF - smsRestoreDatabaseZip UNC path to Remote Code ExecutionCVSS 9.8

Impact

Unauthenticated attackers can control database content, potentially leading to data tampering or execution of malicious code.

Remediation

Implement validation and sanitization of the database file path parameter to restrict to trusted locations.

WeaknessesCWE-89

Authorsdaffainfo, jjcho

Template tagscvecve2022keysightsensor_management_serverrcevkevoastoob

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CPE: cpe:2.3:a:keysight:sensor_management_server:*:*:*:*:*:*:*:*

https://www.tenable.com/security/research/tra-2022-28 https://www.sonicwall.com/blog/keysight-rf-sensor-vulnerability

Source: ProjectDiscovery

References

nvd.nist.gov

https://nvd.nist.gov/vuln/detail/CVE-2022-38130

tenable.com

https://www.tenable.com/security/research/tra-2022-28