CVE-2022-3090

high-risk

Published 2022-11-17

Red Lion Controls Crimson 3.0 versions 707.000 and prior, Crimson 3.1 versions 3126.001 and prior, and Crimson 3.2 versions 3.2.0044.0 and prior are vulnerable to path traversal. When attempting to open a file using a specific path, the user's password hash is sent to an arbitrary host. This could allow an attacker to obtain user credential hashes.

Do I need to act?

0.30% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.5/10 High

NETWORK / LOW complexity

Affected Products (20)

Crimson

Affected Vendors

Redlion

References (2)

Third Party Advisory https://www.cisa.gov/uscert/ics/advisories/icsa-22-321-01

/ 100

high-risk

Severity 26/34 · High

Exploitability 1/34 · Minimal

Exposure 31/34 · Critical