Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
3 vulnerabilities by Tacitine
CVE-2022-40630 (GCVE-0-2022-40630)
Vulnerability from cvelistv5 – Published: 2022-09-23 18:13 – Updated: 2025-05-22 18:16
VLAI
Title
Improper Session Management Vulnerability in Tacitine Firewall
Summary
This vulnerability exists in Tacitine Firewall, all versions of EN6200-PRIME QUAD-35 and EN6200-PRIME QUAD-100 between 19.1.1 to 22.20.1 (inclusive), due to improper session management in the Tacitine Firewall web-based management interface. An unauthenticated remote attacker could exploit this vulnerability by sending a specially crafted http request on the targeted device. Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to perform session fixation on the targeted device.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-384 - Session Fixation
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.cert-in.org.in/s2cMainServlet?pageid=… | x_refsource_MISC |
| https://tacitine.com/newdownload/CVE-2022-40630.pdf | x_refsource_MISC |
Impacted products
Date Public
2022-09-21 00:00
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T12:21:46.556Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01\u0026VLCODE=CIVN-2022-0363"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://tacitine.com/newdownload/CVE-2022-40630.pdf"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-40630",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-22T15:39:37.601840Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-05-22T18:16:08.278Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firewall",
"vendor": "Tacitine",
"versions": [
{
"lessThan": "EN6200-PRIME QUAD-35*",
"status": "affected",
"version": "19.1.1",
"versionType": "custom"
},
{
"lessThan": "EN6200-PRIME QUAD-100*",
"status": "affected",
"version": "19.1.1",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "This vulnerability is reported by Sreedev Kumar from Crowe India"
}
],
"datePublic": "2022-09-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "This vulnerability exists in Tacitine Firewall, all versions of EN6200-PRIME QUAD-35 and EN6200-PRIME QUAD-100 between 19.1.1 to 22.20.1 (inclusive), due to improper session management in the Tacitine Firewall web-based management interface. An unauthenticated remote attacker could exploit this vulnerability by sending a specially crafted http request on the targeted device. Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to perform session fixation on the targeted device."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-384",
"description": "CWE-384 Session Fixation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-09-23T18:13:47.000Z",
"orgId": "66834db9-ab24-42b4-be80-296b2e40335c",
"shortName": "CERT-In"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01\u0026VLCODE=CIVN-2022-0363"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://tacitine.com/newdownload/CVE-2022-40630.pdf"
}
],
"solutions": [
{
"lang": "en",
"value": "Update Tacitine Firewall to latest software version 22.21.2"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Improper Session Management Vulnerability in Tacitine Firewall",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "vdisclose@cert-in.org.in",
"DATE_PUBLIC": "2022-09-21T09:25:00.000Z",
"ID": "CVE-2022-40630",
"STATE": "PUBLIC",
"TITLE": "Improper Session Management Vulnerability in Tacitine Firewall"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Firewall",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "EN6200-PRIME QUAD-35",
"version_value": "19.1.1"
},
{
"version_affected": "\u003c=",
"version_name": "EN6200-PRIME QUAD-35",
"version_value": "22.20.1 +1"
},
{
"version_affected": "\u003e=",
"version_name": "EN6200-PRIME QUAD-100",
"version_value": "19.1.1"
},
{
"version_affected": "\u003c=",
"version_name": "EN6200-PRIME QUAD-100",
"version_value": "22.20.1 +1"
}
]
}
}
]
},
"vendor_name": "Tacitine"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "This vulnerability is reported by Sreedev Kumar from Crowe India"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "This vulnerability exists in Tacitine Firewall, all versions of EN6200-PRIME QUAD-35 and EN6200-PRIME QUAD-100 between 19.1.1 to 22.20.1 (inclusive), due to improper session management in the Tacitine Firewall web-based management interface. An unauthenticated remote attacker could exploit this vulnerability by sending a specially crafted http request on the targeted device. Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to perform session fixation on the targeted device."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-384 Session Fixation"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01\u0026VLCODE=CIVN-2022-0363",
"refsource": "MISC",
"url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01\u0026VLCODE=CIVN-2022-0363"
},
{
"name": "https://tacitine.com/newdownload/CVE-2022-40630.pdf",
"refsource": "MISC",
"url": "https://tacitine.com/newdownload/CVE-2022-40630.pdf"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update Tacitine Firewall to latest software version 22.21.2"
}
],
"source": {
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "66834db9-ab24-42b4-be80-296b2e40335c",
"assignerShortName": "CERT-In",
"cveId": "CVE-2022-40630",
"datePublished": "2022-09-23T18:13:47.025Z",
"dateReserved": "2022-09-13T00:00:00.000Z",
"dateUpdated": "2025-05-22T18:16:08.278Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-40629 (GCVE-0-2022-40629)
Vulnerability from cvelistv5 – Published: 2022-09-23 18:00 – Updated: 2025-05-22 18:16
VLAI
Title
Sensitive Information Disclosure Vulnerability in Tacitine Firewall
Summary
This vulnerability exists in Tacitine Firewall, all versions of EN6200-PRIME QUAD-35 and EN6200-PRIME QUAD-100 between 19.1.1 to 22.20.1 (inclusive), due to insecure design in the Tacitine Firewall web-based management interface. An unauthenticated remote attacker could exploit this vulnerability by sending a specially crafted http request on the targeted device. Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to view sensitive information on the targeted device.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-200 - Information Exposure
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.cert-in.org.in/s2cMainServlet?pageid=… | x_refsource_MISC |
| https://tacitine.com/newdownload/CVE-2022-40629.pdf | x_refsource_MISC |
Impacted products
Date Public
2022-09-21 00:00
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T12:21:46.533Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01\u0026VLCODE=CIVN-2022-0363"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://tacitine.com/newdownload/CVE-2022-40629.pdf"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-40629",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-22T15:30:48.824080Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-05-22T18:16:53.836Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firewall",
"vendor": "Tacitine",
"versions": [
{
"lessThan": "EN6200-PRIME QUAD-35*",
"status": "affected",
"version": "19.1.1",
"versionType": "custom"
},
{
"lessThan": "EN6200-PRIME QUAD-100*",
"status": "affected",
"version": "19.1.1",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "This vulnerability is reported by Sreedev Kumar from Crowe India"
}
],
"datePublic": "2022-09-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "This vulnerability exists in Tacitine Firewall, all versions of EN6200-PRIME QUAD-35 and EN6200-PRIME QUAD-100 between 19.1.1 to 22.20.1 (inclusive), due to insecure design in the Tacitine Firewall web-based management interface. An unauthenticated remote attacker could exploit this vulnerability by sending a specially crafted http request on the targeted device. Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to view sensitive information on the targeted device."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Information Exposure",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-09-23T18:00:37.000Z",
"orgId": "66834db9-ab24-42b4-be80-296b2e40335c",
"shortName": "CERT-In"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01\u0026VLCODE=CIVN-2022-0363"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://tacitine.com/newdownload/CVE-2022-40629.pdf"
}
],
"solutions": [
{
"lang": "en",
"value": "Update Tacitine Firewall to latest software version 22.21.2"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Sensitive Information Disclosure Vulnerability in Tacitine Firewall",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "vdisclose@cert-in.org.in",
"DATE_PUBLIC": "2022-09-21T09:25:00.000Z",
"ID": "CVE-2022-40629",
"STATE": "PUBLIC",
"TITLE": "Sensitive Information Disclosure Vulnerability in Tacitine Firewall"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Firewall",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "EN6200-PRIME QUAD-35",
"version_value": "19.1.1"
},
{
"version_affected": "\u003c=",
"version_name": "EN6200-PRIME QUAD-35",
"version_value": "22.20.1 +1"
},
{
"version_affected": "\u003e=",
"version_name": "EN6200-PRIME QUAD-100",
"version_value": "19.1.1"
},
{
"version_affected": "\u003c=",
"version_name": "EN6200-PRIME QUAD-100",
"version_value": "22.20.1 +1"
}
]
}
}
]
},
"vendor_name": "Tacitine"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "This vulnerability is reported by Sreedev Kumar from Crowe India"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "This vulnerability exists in Tacitine Firewall, all versions of EN6200-PRIME QUAD-35 and EN6200-PRIME QUAD-100 between 19.1.1 to 22.20.1 (inclusive), due to insecure design in the Tacitine Firewall web-based management interface. An unauthenticated remote attacker could exploit this vulnerability by sending a specially crafted http request on the targeted device. Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to view sensitive information on the targeted device."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-200 Information Exposure"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01\u0026VLCODE=CIVN-2022-0363",
"refsource": "MISC",
"url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01\u0026VLCODE=CIVN-2022-0363"
},
{
"name": "https://tacitine.com/newdownload/CVE-2022-40629.pdf",
"refsource": "MISC",
"url": "https://tacitine.com/newdownload/CVE-2022-40629.pdf"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update Tacitine Firewall to latest software version 22.21.2"
}
],
"source": {
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "66834db9-ab24-42b4-be80-296b2e40335c",
"assignerShortName": "CERT-In",
"cveId": "CVE-2022-40629",
"datePublished": "2022-09-23T18:00:37.121Z",
"dateReserved": "2022-09-13T00:00:00.000Z",
"dateUpdated": "2025-05-22T18:16:53.836Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-40628 (GCVE-0-2022-40628)
Vulnerability from cvelistv5 – Published: 2022-09-23 15:37 – Updated: 2025-05-22 19:59
VLAI
Title
Remote Code Execution Vulnerability in Tacitine Firewall
Summary
This vulnerability exists in Tacitine Firewall, all versions of EN6200-PRIME QUAD-35 and EN6200-PRIME QUAD-100 between 19.1.1 to 22.20.1 (inclusive), due to improper control of code generation in the Tacitine Firewall web-based management interface. An unauthenticated remote attacker could exploit this vulnerability by sending a specially crafted http request on the targeted device. Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary commands on the targeted device.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.cert-in.org.in/s2cMainServlet?pageid=… | x_refsource_MISC |
| https://tacitine.com/newdownload/CVE-2022-40628.pdf | x_refsource_MISC |
Impacted products
Date Public
2022-09-21 00:00
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T12:21:46.247Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01\u0026VLCODE=CIVN-2022-0363"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://tacitine.com/newdownload/CVE-2022-40628.pdf"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-40628",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-22T19:59:21.352408Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-05-22T19:59:29.947Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firewall",
"vendor": "Tacitine",
"versions": [
{
"lessThan": "EN6200-PRIME QUAD-35*",
"status": "affected",
"version": "19.1.1",
"versionType": "custom"
},
{
"lessThan": "EN6200-PRIME QUAD-100*",
"status": "affected",
"version": "19.1.1",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "This vulnerability is reported by Sreedev Kumar from Crowe India"
}
],
"datePublic": "2022-09-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "This vulnerability exists in Tacitine Firewall, all versions of EN6200-PRIME QUAD-35 and EN6200-PRIME QUAD-100 between 19.1.1 to 22.20.1 (inclusive), due to improper control of code generation in the Tacitine Firewall web-based management interface. An unauthenticated remote attacker could exploit this vulnerability by sending a specially crafted http request on the targeted device. Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary commands on the targeted device."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-09-23T15:37:32.000Z",
"orgId": "66834db9-ab24-42b4-be80-296b2e40335c",
"shortName": "CERT-In"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01\u0026VLCODE=CIVN-2022-0363"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://tacitine.com/newdownload/CVE-2022-40628.pdf"
}
],
"solutions": [
{
"lang": "en",
"value": "Update Tacitine Firewall to latest software version 22.21.2"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Remote Code Execution Vulnerability in Tacitine Firewall",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "vdisclose@cert-in.org.in",
"DATE_PUBLIC": "2022-09-21T09:25:00.000Z",
"ID": "CVE-2022-40628",
"STATE": "PUBLIC",
"TITLE": "Remote Code Execution Vulnerability in Tacitine Firewall"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Firewall",
"version": {
"version_data": [
{
"version_affected": "\u003e=",
"version_name": "EN6200-PRIME QUAD-35",
"version_value": "19.1.1"
},
{
"version_affected": "\u003c=",
"version_name": "EN6200-PRIME QUAD-35",
"version_value": "22.20.1 +1"
},
{
"version_affected": "\u003e=",
"version_name": "EN6200-PRIME QUAD-100",
"version_value": "19.1.1"
},
{
"version_affected": "\u003c=",
"version_name": "EN6200-PRIME QUAD-100",
"version_value": "22.20.1 +1"
}
]
}
}
]
},
"vendor_name": "Tacitine"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "This vulnerability is reported by Sreedev Kumar from Crowe India"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "This vulnerability exists in Tacitine Firewall, all versions of EN6200-PRIME QUAD-35 and EN6200-PRIME QUAD-100 between 19.1.1 to 22.20.1 (inclusive), due to improper control of code generation in the Tacitine Firewall web-based management interface. An unauthenticated remote attacker could exploit this vulnerability by sending a specially crafted http request on the targeted device. Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary commands on the targeted device."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01\u0026VLCODE=CIVN-2022-0363",
"refsource": "MISC",
"url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01\u0026VLCODE=CIVN-2022-0363"
},
{
"name": "https://tacitine.com/newdownload/CVE-2022-40628.pdf",
"refsource": "MISC",
"url": "https://tacitine.com/newdownload/CVE-2022-40628.pdf"
}
]
},
"solution": [
{
"lang": "en",
"value": "Update Tacitine Firewall to latest software version 22.21.2"
}
],
"source": {
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "66834db9-ab24-42b4-be80-296b2e40335c",
"assignerShortName": "CERT-In",
"cveId": "CVE-2022-40628",
"datePublished": "2022-09-23T15:37:32.259Z",
"dateReserved": "2022-09-13T00:00:00.000Z",
"dateUpdated": "2025-05-22T19:59:29.947Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}