CVE-2022-45914 — MEDIUM (6.5)

Vulnerability Description

The ESL (Electronic Shelf Label) protocol, as implemented by (for example) the OV80e934802 RF transceiver on the ETAG-2130-V4.3 20190629 board, does not use authentication, which allows attackers to change label values via 433 MHz RF signals, as demonstrated by disrupting the organization of a hospital storage unit, or changing retail pricing.

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

HIGH

Availability

NONE

Affected Products

Vendor	Product	Versions
Electronic Shelf Label Protocol Project	Electronic Shelf Label Protocol	-

Related Weaknesses (CWE)

CWE-294

References

http://packetstormsecurity.com/files/170177/Zhuhai-Suny-Technology-ESL-Tag-ForgeExploitThird Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2022/Dec/6ExploitMailing ListThird Party Advisory
https://www.youtube.com/watch?v=FQRMNjZVlHgExploit
http://packetstormsecurity.com/files/170177/Zhuhai-Suny-Technology-ESL-Tag-ForgeExploitThird Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2022/Dec/6ExploitMailing ListThird Party Advisory
https://www.youtube.com/watch?v=FQRMNjZVlHgExploit

FAQ

What is CVE-2022-45914?

CVE-2022-45914 is a vulnerability with a CVSS score of 6.5 (MEDIUM). The ESL (Electronic Shelf Label) protocol, as implemented by (for example) the OV80e934802 RF transceiver on the ETAG-2130-V4.3 20190629 board, does not use authentication, which allows attackers to c...

How severe is CVE-2022-45914?

CVE-2022-45914 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2022-45914?

Check the references section above for vendor advisories and patch information. Affected products include: Electronic Shelf Label Protocol Project Electronic Shelf Label Protocol.