VulnerabilityModified

CVE-2022-26519

There is no limit to the number of attempts to authenticate for the local configuration pages for the Hills ComNav Version 3002-19 interface, which allows local attackers to brute-force credentials.

MEDIUM 5.5EPSS 0.20%

Does this matter?

Lower severity and a low EPSS score (0.20%). Track it; it rarely justifies an emergency change on its own.

Description

There is no limit to the number of attempts to authenticate for the local configuration pages for the Hills ComNav Version 3002-19 interface, which allows local attackers to brute-force credentials.

CVSS 3.1: 5.5 MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS: 0.20% probability · 10th percentile
CISA KEV: Not listed
Weakness: CWE-307
Affected: carrier/hills comnav firmware
Source: ics-cert@hq.dhs.gov

References

https://www.corporate.carrier.com/Images/CARR-PSA-Hills-ComNav-002-1121_tcm558-149392.pdfVendor Advisory
https://www.corporate.carrier.com/Images/CARR-PSA-Hills-ComNav-002-1121_tcm558-149392.pdfVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.