critical9.1
CVE-2022-28223
Tekon KIO devices through 2022-03-30 allow an authenticated admin user to escalate privileges to root by uploading a malicious Lua plugin.
Impact
Tekon KIO devices through 2022-03-30 allow an authenticated admin user to escalate privileges to root by uploading a malicious Lua plugin.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Tekon | Kio Firmware | through 2022-03-30 |
| Tekon | Kio-1m Firmware | through 2022-03-30 |
| Tekon | Kio-2mrs Firmware | through 2022-03-30 |
| Tekon | Kio-2m Firmware | through 2022-03-30 |
| Tekon | Kio-2ms Firmware | through 2022-03-30 |
| Tekon | Kio-2md Firmware | through 2022-03-30 |
| Tekon | Kio-8\(4\) Firmware | through 2022-03-30 |
| Tekon | Kio-8\(4\)L Firmware | through 2022-03-30 |
Weakness classification
References
- NVD record
- CVE.org record
- https://medium.com/%40bertinjoseb/post-auth-rce-based-in-malicious-lua-plugin-script-upload-scada-controllers-located-in-russia-57044425ac38
- https://medium.com/%40bertinjoseb/post-auth-rce-based-in-malicious-lua-plugin-script-upload-scada-controllers-located-in-russia-57044425ac38