CVE-2022-2757

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

Due to the lack of adequately implemented access-control rules, all versions Kingspan TMS300 CS are vulnerable to an attacker viewing and modifying the application settings without authenticating by accessing a specific uniform resource locator (URL) on the webserver.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
Kingspan	TMS300 CS	All Versions

References

https://www.cisa.gov/uscert/ics/advisories/icsa-22-256-04Third Party Advisory, US Government Resource
https://www.cisa.gov/uscert/ics/advisories/icsa-22-256-04Third Party Advisory, US Government Resource

Timeline

Published: Dec 13, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-275709.8Heap-based buffer overflow vulnerability in parser_single_iref function in libsimba library prior to SMR Apr-2022 Release 1 allows code exec CVE-2022-275719.8Heap-based buffer overflow vulnerability in sheifd_get_info_image function in libsimba library prior to SMR Apr-2022 Release 1 allows code e CVE-2022-275729.8Heap-based buffer overflow vulnerability in parser_ipma function of libsimba library prior to SMR Apr-2022 Release 1 allows code execution b CVE-2022-275737.2Improper input validation vulnerability in parser_infe and sheifd_find_itemIndexin fuctions of libsimba library prior to SMR Apr-2022 Releas CVE-2022-275747.2Improper input validation vulnerability in parser_iloc and sheifd_find_itemIndexin fuctions of libsimba library prior to SMR Apr-2022 Releas CVE-2022-275753.3Information exposure vulnerability in One UI Home prior to SMR April-2022 Release 1 allows to access currently launched foreground app infor CVE-2022-275763.3Information exposure vulnerability in Samsung DeX Home prior to SMR April-2022 Release 1 allows to access currently launched foreground app CVE-2022-275779.1The vulnerability in the MSC800 in all versions before 4.15 allows for an attacker to predict the TCP initial sequence number. When the TCP CVE-2022-275787.8An attacker can perform a privilege escalation through the SICK OEE if the application is installed in a directory where non authenticated o CVE-2022-275797.8A deserialization vulnerability in a .NET framework class used and not properly checked by Flexi Soft Designer in all versions up to and inc CVE-2022-27585.9Passwords are not adequately encrypted during the communication process between all versions of LS Industrial Systems (LSIS) Co. Ltd LS Elec CVE-2022-275807.8A deserialization vulnerability in a .NET framework class used and not properly checked by Safety Designer all versions up to and including