Published:2023/03/02 Last Updated:2023/03/02
JVNVU#96890975
Multiple vulnerabilities in Edgecross Basic Software for Windows
Overview
Edgecross Basic Software for Windows contains multiple vulnerabilities.
Products Affected
- Edgecross Basic Software for Windows ECP-BS1-W, versions from 1.10 to 1.26
- Edgecross Basic Software for Developers ECP-BS1-W-D, versions from 1.10 to 1.26
Description
Edgecross Basic Software for Windows, provided by Edgecross Consortium, contains third-party components.
The following vulnerabilities of the components affect Edgecross Basic Software.
- CVE-2022-0778 (OpenSSL)
- CVE-2022-29862, CVE-2022-29864 (OPC UA .NET Standard Stack)
Impact
When Management Shell Service is not stopped, crafted packets may cause the Denial-of-Service (DoS) condition.
Solution
Update the Software
Update to the latest version according to the information provided by the developer.
Apply the Workaround
Until the system is updated, the developer recommends the workarounds.
Refer to the information provided by the developer.
Vendor Status
Vendor | Link |
Edgecross Consortium | Multiple vulnerabilities in Edgecross Basic Software for Windows |
Downloads |
References
-
OpenSSL Security Advisory [15 March 2022]
Infinite loop in BN_mod_sqrt() reachable when parsing certificates (CVE-2022-0778) -
OPC Foundation Security Bulletin CVE-2022-29862
Security Update for the OPC UA .NET Standard Stack -
OPC Foundation Security Bulletin CVE-2022-29864
Security Update for the OPC UA .NET Standard Stack
JPCERT/CC Addendum
Vulnerability Analysis by JPCERT/CC
CVSS v3
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base Score:
7.5
Attack Vector(AV) | Physical (P) | Local (L) | Adjacent (A) | Network (N) |
---|---|---|---|---|
Attack Complexity(AC) | High (H) | Low (L) | ||
Privileges Required(PR) | High (H) | Low (L) | None (N) | |
User Interaction(UI) | Required (R) | None (N) | ||
Scope(S) | Unchanged (U) | Changed (C) | ||
Confidentiality Impact(C) | None (N) | Low (L) | High (H) | |
Integrity Impact(I) | None (N) | Low (L) | High (H) | |
Availability Impact(A) | None (N) | Low (L) | High (H) |
Credit
Edgecross Consortium reported these vulnerabilities to JPCERT/CC to notify users of its solutions through JVN.