CVE-2022-31765

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Affected devices do not properly authorize the change password function of the web interface. This could allow low privileged users to escalate their privileges.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-862

Affected software

VendorProductVersions
SiemensRUGGEDCOM RM1224 LTE(4G) EU< V7.1.2
SiemensRUGGEDCOM RM1224 LTE(4G) NAM< V7.1.2
SiemensSCALANCE M804PB< V7.1.2
SiemensSCALANCE M812-1 ADSL-Router< V7.1.2
SiemensSCALANCE M812-1 ADSL-Router< V7.1.2
SiemensSCALANCE M816-1 ADSL-Router< V7.1.2
SiemensSCALANCE M816-1 ADSL-Router< V7.1.2
SiemensSCALANCE M826-2 SHDSL-Router< V7.1.2
SiemensSCALANCE M874-2< V7.1.2
SiemensSCALANCE M874-3< V7.1.2
SiemensSCALANCE M876-3< V7.1.2
SiemensSCALANCE M876-3 (ROK)< V7.1.2
SiemensSCALANCE M876-4< V7.1.2
SiemensSCALANCE M876-4 (EU)< V7.1.2
SiemensSCALANCE M876-4 (NAM)< V7.1.2
SiemensSCALANCE MUM853-1 (EU)< V7.1.2
SiemensSCALANCE MUM856-1 (EU)< V7.1.2
SiemensSCALANCE MUM856-1 (RoW)< V7.1.2
SiemensSCALANCE S615 EEC LAN-Router< V7.1.2
SiemensSCALANCE S615 LAN-Router< V7.1.2
SiemensSCALANCE SC622-2CAll versions < V3.0
SiemensSCALANCE SC632-2CAll versions < V3.0
SiemensSCALANCE SC636-2CAll versions < V3.0
SiemensSCALANCE SC642-2CAll versions < V3.0
SiemensSCALANCE SC646-2CAll versions < V3.0
SiemensSCALANCE W1748-1 M12< *
SiemensSCALANCE W1748-1 M12< *
SiemensSCALANCE W1788-1 M12< *
SiemensSCALANCE W1788-2 EEC M12< *
SiemensSCALANCE W1788-2 M12< *
SiemensSCALANCE W1788-2IA M12< *
SiemensSCALANCE W721-1 RJ45< V6.6.0
SiemensSCALANCE W721-1 RJ45< V6.6.0
SiemensSCALANCE W721-1 RJ45< V6.6.0
SiemensSCALANCE W721-1 RJ45< V6.6.0
SiemensSCALANCE W722-1 RJ45< V6.6.0
SiemensSCALANCE W722-1 RJ45< V6.6.0
SiemensSCALANCE W722-1 RJ45< V6.6.0
SiemensSCALANCE W722-1 RJ45< V6.6.0
SiemensSCALANCE W722-1 RJ45< V6.6.0
SiemensSCALANCE W722-1 RJ45< V6.6.0
SiemensSCALANCE W734-1 RJ45< V6.6.0
SiemensSCALANCE W734-1 RJ45< V6.6.0
SiemensSCALANCE W734-1 RJ45< V6.6.0
SiemensSCALANCE W734-1 RJ45< V6.6.0
SiemensSCALANCE W734-1 RJ45< V6.6.0
SiemensSCALANCE W734-1 RJ45< V6.6.0
SiemensSCALANCE W734-1 RJ45 (USA)< V6.6.0
SiemensSCALANCE W734-1 RJ45 (USA)< V6.6.0
SiemensSCALANCE W738-1 M12< V6.6.0

References

Timeline

Published
Oct 11, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-317668.6A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V7.1.2), RUGGEDCOM RM1224 LTE(4G) NACVE-2022-317679.8IBM CICS TX Standard and Advanced 11.1 could allow a remote attacker to execute arbitrary commands on the system by sending a specially crafCVE-2022-317689.8IBM InfoSphere Information Server 11.7 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which CVE-2022-317695.3IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.15.0 could allow a remote attacker to view product configuration information stored inCVE-2022-317704.9IBM App Connect Enterprise Certified Container 4.2 could allow a user from the administration console to cause a denial of service by creatiCVE-2022-317726.5IBM MQ 8.0, 9.0 LTS, 9.1 CD, 9.1 LTS, 9.2 CD, and 9.2 LTS could allow an authenticated and authorized user to cause a denial of service to tCVE-2022-317738.8IBM DataPower Gateway V10CD, 10.0.1, and 2018.4.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicCVE-2022-317745.4IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to crCVE-2022-317759.1IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to anCVE-2022-317768.8IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to seCVE-2022-317775.4A stored cross-site scripting (XSS) vulnerability in Apache Spark 3.2.1 and earlier, and 3.3.0, allows remote attackers to execute arbitraryCVE-2022-317787.5Improper Input Validation vulnerability in handling the Transfer-Encoding header of Apache Traffic Server allows an attacker to poison the c