CVE-2022-29518 : Security Advisory and Response

This CVE involves Screen Creator Advance2, HMI GC-A2 series, and Real-time remote monitoring and control tool. An attacker can bypass authentication, leading to unauthorized access and potential manipulation of information stored.

Understanding CVE-2022-29518

This vulnerability impacts Screen Creator Advance2 versions prior to Ver.0.1.1.3 Build01, HMI GC-A2 series, and Real-time remote monitoring and control tool from KOYO ELECTRONICS INDUSTRIES CO., LTD.

What is CVE-2022-29518?

The CVE allows a local attacker to bypass authentication by exploiting inadequate account name checks in the Remote control setting, potentially enabling unauthorized operations on the HMI.

The Impact of CVE-2022-29518

If exploited, attackers could disclose, delete, or alter sensitive information within the HMI, and even illegitimately operate equipment via the compromised HMI.

Technical Details of CVE-2022-29518

This section explores the specifics of the vulnerability.

Vulnerability Description

The vulnerability arises from improper authentication checks, providing a loophole for unauthorized access.

Affected Systems and Versions

Screen Creator Advance2 versions prior to Ver.0.1.1.3 Build01, HMI GC-A2 series (GC-A22W-CW, GC-A24W-C(W), GC-A26W-C(W), GC-A24, GC-A24-M, GC-A25, GC-A26, and GC-A26-J2), and Real-time remote monitoring and control tool are affected.

Exploitation Mechanism

Attackers exploit the inadequate account name verification in the Remote control setting to bypass authentication and gain unauthorized access.

Mitigation and Prevention

Protect your systems against CVE-2022-29518 with the following measures.

Immediate Steps to Take

Update to the latest version (Ver.0.1.1.3 Build01) of Screen Creator Advance2.
Implement strong account name verification mechanisms.

Long-Term Security Practices

Conduct regular security audits to identify vulnerabilities.
Train employees on secure authentication practices.

Patching and Updates

Stay informed about security patches and promptly apply updates to mitigate known vulnerabilities.