CVE-2022-28223

Tekon KIO devices through 2022-03-30 allow an authenticated admin user to escalate privileges to root by uploading a malicious Lua plugin.

Score

CVSS 3.1 9.1 Critical

Status

Modified - cve@mitre.org

Published

2022-03-30

Last modified

2024-08-03

Weaknesses

CWE-434

Affected products

• Kio-1m Firmware (Tekon)
• Kio-2m Firmware (Tekon)
• Kio-2md Firmware (Tekon)
• Kio-2mrs Firmware (Tekon)
• Kio-2ms Firmware (Tekon)
• Kio-8(4) Firmware (Tekon)
• Kio-8(4)l Firmware (Tekon)
• Kio Firmware (Tekon)

References

• https://medium.com/%40bertinjoseb/post-auth-rce-based-in-malicious-lua-plugin-script-upload-scada-controllers-located-i…