CVE-2022-35513
Published: 07 September 2022
Summary
CVE-2022-35513 is a high-severity Use of a Broken or Risky Cryptographic Algorithm (CWE-327) vulnerability in Blink1 Blink1Control2. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 8.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The vulnerability in CVE-2022-35513 affects the Blink1Control2 application at version 2.2.7 and earlier. It stems from the use of weak password encryption combined with an insecure storage method, corresponding to CWE-327 and CWE-922, and carries a CVSS 3.1 score of 7.5 reflecting network attack vector, low complexity, and high confidentiality impact without requiring privileges or user interaction.
An unauthenticated attacker with network access can exploit the flaw to recover sensitive credentials or other stored data from the application, achieving unauthorized disclosure of information that the weak encryption and storage practices were intended to protect.
Public references include a GitHub repository with proof-of-concept details, a PacketStorm advisory entry, and the project's release page on GitHub, though no explicit mitigation steps or patch guidance are described in the available information. The associated EPSS score remains low, with a current value of 0.0629 and a peak of 0.0670.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-6858
Vulnerability details
The Blink1Control2 application <= 2.2.7 uses weak password encryption and an insecure method of storage.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Contacts with security groups provide timely information on broken or risky cryptographic algorithms, reducing the likelihood of their selection and use.
Tracking information locations and access supports secure storage practices instead of insecure ones.
Establishing an alternate site with equivalent protections directly mitigates insecure storage of sensitive backup information.
Requiring protection of backup information directly addresses insecure storage of sensitive data in backups.
Ongoing education and sharing of recommended practices helps organizations identify and migrate away from broken or risky cryptographic algorithms.
Cross-organization threat feeds commonly include advances in cryptanalysis and active exploits against weak or broken algorithms, allowing organizations to deprecate them proactively.
Policy explicitly addresses insecure storage of CUI on external systems, requiring compliant handling and protections.
Capital planning and funding allow selection and ongoing support of strong cryptographic algorithms rather than weak or broken ones.