CVE-2022-3090

State: Published
Severity: 7.5 High
Published: Nov 17, 2022
Updated: Apr 16, 2025
Reserved: Sep 1, 2022

Description

Red Lion Controls Crimson 3.0 versions 707.000 and prior, Crimson 3.1 versions 3126.001 and prior, and Crimson 3.2 versions 3.2.0044.0 and prior are vulnerable to path traversal. When attempting to open a file using a specific path, the user's password hash is sent to an arbitrary host. This could allow an attacker to obtain user credential hashes.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	icscert

Weaknesses

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected Products

Product	Versions
Crimson 3.0Red Lion Controls	All versions through 707.000Affected
Crimson 3.1Red Lion Controls	All versions through 3126.001Affected
Crimson 3.2Red Lion Controls	All versions through 3.2.0044.0Affected

References

https://www.cisa.gov/uscert/ics/advisories/icsa-22-321-01

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.