CVE-2022-25922

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

Power Line Communications PLC4TRUCKS J2497 trailer brake controllers implement diagnostic functions which can be invoked by replaying J2497 messages. There is no authentication or authorization for these functions.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-306

Affected software

No affected versions have been published.

Timeline

Published
Mar 10, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-259239.8Versions of the package exec-local-bin before 1.2.0 are vulnerable to Command Injection via the theProcess() functionality due to improper uCVE-2022-259267.8Versions of the package window-control before 1.4.5 are vulnerable to Command Injection via the sendKeys function, due to improper input sanCVE-2022-259277.5Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are vulnerable to Regular Expression DenialCVE-2022-259295.4The package smoothie from 1.31.0 and before 1.36.1 are vulnerable to Cross-site Scripting (XSS) due to improper user input sanitization in sCVE-2022-25937.2The Better Search Replace WordPress plugin before 1.4.1 does not properly sanitise and escape table data before inserting it into a SQL querCVE-2022-259317.5All versions of package easy-static-server are vulnerable to Directory Traversal due to missing input sanitization and sandboxes being emploCVE-2022-259329.8The firmware of InHand Networks InRouter302 V3.5.45 introduces fixes for TALOS-2022-1472 and TALOS-2022-1474. The fixes are incomplete. An aCVE-2022-259367.5Versions of the package servst before 2.0.3 are vulnerable to Directory Traversal due to improper sanitization of the filePath variable.CVE-2022-259376.5Versions of the package glance before 3.0.9 are vulnerable to Directory Traversal that allows users to read files outside the public root diCVE-2022-25948.8The Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro WordPress plugin before 5.12.3 allows unauthenticated CVE-2022-259407.5All versions of package lite-server are vulnerable to Denial of Service (DoS) when an attacker sends an HTTP request and includes control chCVE-2022-259427.8An out-of-bounds read vulnerability exists in the gif2h5 functionality of HDF5 Group libhdf5 1.10.4. A specially-crafted GIF file can lead t
CVE-2022-25922: Critical severity, CVSS 9.1 | Vulnix