CVE-2022-32514

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A CWE-287: Improper Authentication vulnerability exists that could allow an attacker to gain control of the device when logging into a web page. Affected Products: C-Bus Network Automation Controller - LSS5500NAC (Versions prior to V1.10.0), Wiser for C-Bus Automation Controller - LSS5500SHAC (Versions prior to V1.10.0), Clipsal C-Bus Network Automation Controller - 5500NAC (Versions prior to V1.10.0), Clipsal Wiser for C-Bus Automation Controller - 5500SHAC (Versions prior to V1.10.0), SpaceLogic C-Bus Network Automation Controller - 5500NAC2 (Versions prior to V1.10.0), SpaceLogic C-Bus Application Controller - 5500AC2 (Versions prior to V1.10.0)

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

VendorProductVersions
Schneider ElectricC-Bus Network Automation Controller, LSS5500NAC>= All, < V1.10.0
Schneider ElectricWiser for C-Bus Automation Controller, LSS5500SHAC>= All, < V1.10.0
Schneider ElectricClipsal C-Bus Network Automation Controller, 5500NAC>= All, < V1.10.0
Schneider ElectricClipsal Wiser for C-Bus Automation Controller, 5500SHAC>= All, < V1.10.0
Schneider ElectricSpaceLogic C-Bus Network Automation Controller, 5500NAC2>= All, < V1.10.0
Schneider ElectricSpaceLogic C-Bus Application Controller, 5500AC2>= All, < V1.10.0

References

Timeline

Published
Jan 30, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-325159.8A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could cause brute force attacks to take over CVE-2022-325166.5A CWE-352: Cross-Site Request Forgery (CSRF) vulnerability exists that could cause system’s configurations override and cause a reboot loop CVE-2022-325176.5A CWE-1021: Improper Restriction of Rendered UI Layers or Frames vulnerability exists that could cause an adversary to trick the interface uCVE-2022-325189.8A CWE-522: Insufficiently Protected Credentials vulnerability exists that could result in unwanted access to a DCE instance when performed oCVE-2022-325199.8A CWE-257: Storing Passwords in a Recoverable Format vulnerability exists that could result in unwanted access to a DCE instance when perforCVE-2022-32527.5Improper detection of complete HTTP body decompression SwiftNIO Extras provides a pair of helpers for transparently decompressing received HCVE-2022-325209.8A CWE-522: Insufficiently Protected Credentials vulnerability exists that could result in unwanted access to a DCE instance when performed oCVE-2022-325218.8A CWE 502: Deserialization of Untrusted Data vulnerability exists that could allow code to be remotely executed on the server when unsafely CVE-2022-325229.8A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leadiCVE-2022-325239.8A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leadiCVE-2022-325249.8A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leadiCVE-2022-325259.8A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leadi