Published:2023/03/02  Last Updated:2023/03/02

JVNVU#96890975
Multiple vulnerabilities in Edgecross Basic Software for Windows

Overview

Edgecross Basic Software for Windows contains multiple vulnerabilities.

Products Affected

  • Edgecross Basic Software for Windows ECP-BS1-W, versions from 1.10 to 1.26
  • Edgecross Basic Software for Developers ECP-BS1-W-D, versions from 1.10 to 1.26
The developer provides the information how to check the version numbers.

Description

Edgecross Basic Software for Windows, provided by Edgecross Consortium, contains third-party components.
The following vulnerabilities of the components affect Edgecross Basic Software.

  • CVE-2022-0778 (OpenSSL)
  • CVE-2022-29862, CVE-2022-29864 (OPC UA .NET Standard Stack)​

Impact

When Management Shell Service is not stopped, crafted packets may cause the Denial-of-Service (DoS) condition.

Solution

Update the Software
Update to the latest version according to the information provided by the developer.

Apply the Workaround
Until the system is updated, the developer recommends the workarounds.
Refer to the information provided by the developer.

Vendor Status

Vendor Link
Edgecross Consortium Multiple vulnerabilities in Edgecross Basic Software for Windows
Downloads

References

  1. OpenSSL Security Advisory [15 March 2022]
    Infinite loop in BN_mod_sqrt() reachable when parsing certificates (CVE-2022-0778)
  2. OPC Foundation Security Bulletin CVE-2022-29862
    Security Update for the OPC UA .NET Standard Stack
  3. OPC Foundation Security Bulletin CVE-2022-29864
    Security Update for the OPC UA .NET Standard Stack

JPCERT/CC Addendum

Vulnerability Analysis by JPCERT/CC

CVSS v3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base Score: 7.5
Attack Vector(AV) Physical (P) Local (L) Adjacent (A) Network (N)
Attack Complexity(AC) High (H) Low (L)
Privileges Required(PR) High (H) Low (L) None (N)
User Interaction(UI) Required (R) None (N)
Scope(S) Unchanged (U) Changed (C)
Confidentiality Impact(C) None (N) Low (L) High (H)
Integrity Impact(I) None (N) Low (L) High (H)
Availability Impact(A) None (N) Low (L) High (H)

Credit

Edgecross Consortium reported these vulnerabilities to JPCERT/CC to notify users of its solutions through JVN.

Other Information

JPCERT Alert
JPCERT Reports
CERT Advisory
CPNI Advisory
TRnotes
CVE
JVN iPedia