CVE-2022-29898

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

On various RAD-ISM-900-EN-* devices by PHOENIX CONTACT an admin user could use the configuration file uploader in the WebUI to execute arbitrary code with root privileges on the OS due to an improper validation of an integrity check value in all versions of the firmware.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-354

Affected software

VendorProductVersions
PHOENIX CONTACTRAD-ISM-900-EN-BD/BAll Versions
PHOENIX CONTACTRAD-ISM-900-EN-BDAll Versions
PHOENIX CONTACTRAD-ISM-900-EN-BD-BUSAll Versions

References

Timeline

Published
May 11, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-29907.1An incorrect handling of the supplementary groups in the Buildah container engine might lead to the sensitive information disclosure or possCVE-2022-299006.5Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution under certain microarchitecture-dependCVE-2022-299016.5Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their retpoline mitigation in the kerneCVE-2022-299034.3The Private Domains extension for MediaWiki through 1.37.2 (before 1ad65d4c1c199b375ea80988d99ab51ae068f766) allows CSRF for editing pages tCVE-2022-299049.8The SemanticDrilldown extension for MediaWiki through 1.37.2 (before e688bdba6434591b5dff689a45e4d53459954773) allows SQL injection with cerCVE-2022-299054.3The FanBoxes extension for MediaWiki through 1.37.2 (before 027ffb0b9d6fe0d823810cf03f5b562a212162d4) allows Special:UserBoxes CSRF.CVE-2022-299069.8The admin API module in the QuizGame extension for MediaWiki through 1.37.2 (before 665e33a68f6fa1167df99c0aa18ed0157cdf9f66) omits a check CVE-2022-299076.1The Nimbus skin for MediaWiki through 1.37.2 (before 6f9c8fb868345701d9544a54d9752515aace39df) allows XSS in Advertise link messages.CVE-2022-299087.8The folioupdate service in Fabasoft Cloud Enterprise Client 22.4.0043 allows Local Privilege Escalation.CVE-2022-299098.8Documents in deeply-nested cross-origin browsing contexts could have obtained permissions granted to the top-level origin, bypassing the exiCVE-2022-29916.7A heap-based buffer overflow was found in the Linux kernel's LightNVM subsystem. The issue results from the lack of proper validation of theCVE-2022-299106.1When closed or sent to the background, Firefox for Android would not properly record and persist HSTS settings.<br>*Note: This issue only af
CVE-2022-29898: Critical severity, CVSS 9.1 | Vulnix