CVE-2022-2988

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A CWE-787: Out-of-bounds Write vulnerability exists that could cause sensitive information leakage when accessing a malicious web page from the commissioning software. Affected Products: SoMachine HVAC (Versions prior to V2.1.0), EcoStruxure Machine Expert – HVAC (Versions prior to V1.4.0)

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published: Jan 30, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-298806.5A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not properly validate input in the configuration i CVE-2022-298815.3A vulnerability has been identified in SICAM T (All versions < V3.0). The web based management interface of affected devices does not employ CVE-2022-298827.1A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not handle uploaded files correctly. An unauthenti CVE-2022-298835.3A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not restrict unauthenticated access to certain pag CVE-2022-298847.5A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70°C (All versions < CPC80 V16.30), CP-8000 MASTER MODULE WITH I/CVE-2022-298857.5The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to 8.5.78 for the EncryptInter CVE-2022-298867.8An integer overflow vulnerability exists in the way ESTsoft Alyac 2.5.8.544 parses OLE files. A specially-crafted OLE file can lead to a hea CVE-2022-298879.6Cross-site Scripting (XSS) in some Intel(R) Manageability Commander software before version 2.3 may allow an unauthenticated user to potenti CVE-2022-298888.1A leftover debug code vulnerability exists in the httpd port 4444 upload.cgi functionality of InHand Networks InRouter302 V3.5.45. A special CVE-2022-298899.8A hard-coded password vulnerability exists in the telnet functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z. Use of a ha CVE-2022-29897.1An incorrect handling of the supplementary groups in the Podman container engine might lead to the sensitive information disclosure or possi CVE-2022-298906.1In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in the support link.