CVE-2022-26423
Published: 21 October 2022
Summary
CVE-2022-26423 is a high-severity Missing Authorization (CWE-862) vulnerability in Aethon Tug Home Base Server. Its CVSS base score is 8.2 (High).
Operationally, ranked in the top 34.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-30982
Vulnerability details
Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user credentials.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Associating and retaining security attributes with data directly supports enforcement of access control decisions across storage, processing, and transmission.
Enforces rules governing access to the system and its data from external systems based on established trust relationships.
This control requires verifying that a sharing partner's access authorizations match the information's restrictions before sharing occurs.
Session auditing enables detection of unauthorized exposure or access to sensitive information during user activities.
Sanitizing equipment to remove specified information before off-site maintenance prevents exposure of sensitive information to unauthorized actors such as external maintenance personnel.
Requiring detailed, requestable records of every PII disclosure directly aids detection of unauthorized exposures of sensitive information.
Data governance body defines and oversees organizational access control policies for data resources, reducing improper access control.
Annual reviews and proposal scrutiny detect and block matching programs that would expose sensitive data to unauthorized recipients or systems.