CVE-2022-35648

low-risk
Published 2022-07-12

Nautilus treadmills T616 S/N 100672PRO21140001 through 100672PRO21171980 and T618 S/N 100647PRO21130111 through 100647PRO21183960 with software before 2022-06-09 allow physically proximate attackers to cause a denial of service (fall) by connecting the power cord to a 120V circuit (which may lead to self-starting at an inopportune time).

Do I need to act?

-
0.08% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
2
CVSS 2.6/10 Low
PHYSICAL / LOW complexity

Affected Products (2)

T618 Firmware
T616 Firmware

Affected Vendors

Nautilus

References (6)

Third Party Advisory https://cwe.mitre.org/data/definitions/372.html
Product https://download.nautilus.com/pdf/NLS.T616-T618.cpsc.safety.notice.EN.pdf
Product https://www.cpsc.gov/Recalls/2022/Nautilus-Recalls-Treadmills-Due-to-Fall-Hazard
Third Party Advisory https://cwe.mitre.org/data/definitions/372.html
Product https://download.nautilus.com/pdf/NLS.T616-T618.cpsc.safety.notice.EN.pdf
Product https://www.cpsc.gov/Recalls/2022/Nautilus-Recalls-Treadmills-Due-to-Fall-Hazard
18
/ 100
low-risk
Severity 11/34 · Low
Exploitability 0/34 · Minimal
Exposure 7/34 · Low