CVE-2022-29878

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices use a limited range for challenges that are sent during the unencrypted challenge-response communication. An unauthenticated attacker could capture a valid challenge-response pair generated by a legitimate user, and request the webpage repeatedly to wait for the same challenge to reappear for which the correct response is known. This could allow the attacker to access the management interface of the device.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-294

Affected software

No affected versions have been published.

Timeline

Published
May 20, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-298794.3A vulnerability has been identified in SICAM T (All versions < V3.0). The web based management interface of affected devices does not employCVE-2022-29887.5A CWE-787: Out-of-bounds Write vulnerability exists that could cause sensitive information leakage when accessing a malicious web page from CVE-2022-298806.5A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not properly validate input in the configuration iCVE-2022-298815.3A vulnerability has been identified in SICAM T (All versions < V3.0). The web based management interface of affected devices does not employCVE-2022-298827.1A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not handle uploaded files correctly. An unauthentiCVE-2022-298835.3A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not restrict unauthenticated access to certain pagCVE-2022-298847.5A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70°C (All versions < CPC80 V16.30), CP-8000 MASTER MODULE WITH I/CVE-2022-298857.5The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to 8.5.78 for the EncryptInterCVE-2022-298867.8An integer overflow vulnerability exists in the way ESTsoft Alyac 2.5.8.544 parses OLE files. A specially-crafted OLE file can lead to a heaCVE-2022-298879.6Cross-site Scripting (XSS) in some Intel(R) Manageability Commander software before version 2.3 may allow an unauthenticated user to potentiCVE-2022-298888.1A leftover debug code vulnerability exists in the httpd port 4444 upload.cgi functionality of InHand Networks InRouter302 V3.5.45. A specialCVE-2022-298899.8A hard-coded password vulnerability exists in the telnet functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z. Use of a ha