CVE-2022-22509

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

In Phoenix Contact FL SWITCH Series 2xxx in version 3.00 an incorrect privilege assignment allows an low privileged user to enable full access to the device configuration.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://cert.vde.com/en/advisories/VDE-2022-001/Mitigation, Third Party Advisory
https://cert.vde.com/en/advisories/VDE-2022-001/Mitigation, Third Party Advisory

Timeline

Published: Feb 2, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-22518.0Improper sanitization of branch names in GitLab Runner affecting all versions prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.CVE-2022-225107.5Codesys Profinet in version V4.2.0.0 is prone to null pointer dereference that allows a denial of service (DoS) attack of an unauthenticated CVE-2022-225115.4Various configuration pages of the device are vulnerable to reflected XSS (Cross-Site Scripting) attacks. An authorized attacker with user p CVE-2022-225129.8Hard-coded credentials in Web-UI of multiple VARTA Storage products in multiple versions allows an unauthorized attacker to gain administrat CVE-2022-225136.5An authenticated remote attacker can cause a null pointer dereference in the CmpSettings component of the affected CODESYS products which le CVE-2022-225147.1An authenticated, remote attacker can gain access to a dereferenced pointer contained in a request. The accesses can subsequently lead to lo CVE-2022-225158.1A remote, authenticated attacker could utilize the control program of the CODESYS Control runtime system to use the vulnerability in order t CVE-2022-225167.8The SysDrv3S driver in the CODESYS Control runtime system on Microsoft Windows allows any system user to read and write within restricted me CVE-2022-225177.5An unauthenticated, remote attacker can disrupt existing communication channels between CODESYS products by guessing a valid channel ID and CVE-2022-225186.5A bug in CmpUserMgr component can lead to only partially applied security policies. This can result in enabled, anonymous access to componen CVE-2022-225197.5A remote, unauthenticated attacker can send a specific crafted HTTP or HTTPS requests causing a buffer over-read resulting in a crash of the CVE-2022-22526.1Open Redirect in GitHub repository microweber/microweber prior to 1.2.19.