CVE-2022-39030 (GCVE-0-2022-39030)
Vulnerability from cvelistv5 – Published: 2022-09-28 03:25 – Updated: 2025-05-21 14:52
VLAI
Title
Smart eVision - Exposure of Sensitive Information to an Unauthorized Actor -2
Summary
smart eVision has inadequate authorization for system information query function. An unauthenticated remote attacker, who is not explicitly authorized to access the information, can access sensitive information.
Severity
7.5 (High)
CWE
- CWE-200 - Information Exposure
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.twcert.org.tw/tw/cp-132-6567-01fa3-1.html | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Smart eVision Information Technology Inc. | Smart eVision |
Affected:
2022.02.21
|
Date Public
2022-09-28 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T11:10:32.291Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.twcert.org.tw/tw/cp-132-6567-01fa3-1.html"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-39030",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-21T14:52:41.223965Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-05-21T14:52:48.240Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Smart eVision",
"vendor": "Smart eVision Information Technology Inc.",
"versions": [
{
"status": "affected",
"version": "2022.02.21"
}
]
}
],
"datePublic": "2022-09-28T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "smart eVision has inadequate authorization for system information query function. An unauthenticated remote attacker, who is not explicitly authorized to access the information, can access sensitive information."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Information Exposure",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-09-28T03:25:36.000Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.twcert.org.tw/tw/cp-132-6567-01fa3-1.html"
}
],
"solutions": [
{
"lang": "en",
"value": "Contact tech support from Smart eVision Information Technology Inc."
}
],
"source": {
"advisory": "TVN-202209003",
"discovery": "EXTERNAL"
},
"title": "Smart eVision - Exposure of Sensitive Information to an Unauthorized Actor -2",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "TWCERT/CC",
"ASSIGNER": "cve@cert.org.tw",
"DATE_PUBLIC": "2022-09-28T03:00:00.000Z",
"ID": "CVE-2022-39030",
"STATE": "PUBLIC",
"TITLE": "Smart eVision - Exposure of Sensitive Information to an Unauthorized Actor -2"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Smart eVision",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "2022.02.21"
}
]
}
}
]
},
"vendor_name": "Smart eVision Information Technology Inc."
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "smart eVision has inadequate authorization for system information query function. An unauthenticated remote attacker, who is not explicitly authorized to access the information, can access sensitive information."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-200 Information Exposure"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.twcert.org.tw/tw/cp-132-6567-01fa3-1.html",
"refsource": "MISC",
"url": "https://www.twcert.org.tw/tw/cp-132-6567-01fa3-1.html"
}
]
},
"solution": [
{
"lang": "en",
"value": "Contact tech support from Smart eVision Information Technology Inc."
}
],
"source": {
"advisory": "TVN-202209003",
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2022-39030",
"datePublished": "2022-09-28T03:25:36.185Z",
"dateReserved": "2022-08-30T00:00:00.000Z",
"dateUpdated": "2025-05-21T14:52:48.240Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2022-39030",
"date": "2026-05-30",
"epss": "0.00849",
"percentile": "0.7518"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2022-39030\",\"sourceIdentifier\":\"twcert@cert.org.tw\",\"published\":\"2022-09-28T04:15:14.547\",\"lastModified\":\"2024-11-21T07:17:24.643\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"smart eVision has inadequate authorization for system information query function. An unauthenticated remote attacker, who is not explicitly authorized to access the information, can access sensitive information.\"},{\"lang\":\"es\",\"value\":\"smart eVision presenta autorizaci\u00f3n inapropiada para la funci\u00f3n system information query. Un atacante remoto no autenticado, que no est\u00e9 expl\u00edcitamente autorizado para acceder a la informaci\u00f3n, puede acceder a informaci\u00f3n confidencial\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"twcert@cert.org.tw\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"twcert@cert.org.tw\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-200\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-863\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:lcnet:smart_evision:2022.02.21:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C0BD6F48-0614-4FCE-ACA4-EAB16D9B1E22\"}]}]}],\"references\":[{\"url\":\"https://www.twcert.org.tw/tw/cp-132-6567-01fa3-1.html\",\"source\":\"twcert@cert.org.tw\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.twcert.org.tw/tw/cp-132-6567-01fa3-1.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}",
"vulnrichment": {
"containers": "{\"cna\": {\"affected\": [{\"product\": \"Smart eVision\", \"vendor\": \"Smart eVision Information Technology Inc.\", \"versions\": [{\"status\": \"affected\", \"version\": \"2022.02.21\"}]}], \"datePublic\": \"2022-09-28T00:00:00.000Z\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"smart eVision has inadequate authorization for system information query function. An unauthenticated remote attacker, who is not explicitly authorized to access the information, can access sensitive information.\"}], \"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"LOW\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"NONE\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"scope\": \"UNCHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\", \"version\": \"3.1\"}}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-200\", \"description\": \"CWE-200 Information Exposure\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2022-09-28T03:25:36.000Z\", \"orgId\": \"cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e\", \"shortName\": \"twcert\"}, \"references\": [{\"tags\": [\"x_refsource_MISC\"], \"url\": \"https://www.twcert.org.tw/tw/cp-132-6567-01fa3-1.html\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Contact tech support from Smart eVision Information Technology Inc.\"}], \"source\": {\"advisory\": \"TVN-202209003\", \"discovery\": \"EXTERNAL\"}, \"title\": \"Smart eVision - Exposure of Sensitive Information to an Unauthorized Actor -2\", \"x_generator\": {\"engine\": \"Vulnogram 0.0.9\"}, \"x_legacyV4Record\": {\"CVE_data_meta\": {\"AKA\": \"TWCERT/CC\", \"ASSIGNER\": \"cve@cert.org.tw\", \"DATE_PUBLIC\": \"2022-09-28T03:00:00.000Z\", \"ID\": \"CVE-2022-39030\", \"STATE\": \"PUBLIC\", \"TITLE\": \"Smart eVision - Exposure of Sensitive Information to an Unauthorized Actor -2\"}, \"affects\": {\"vendor\": {\"vendor_data\": [{\"product\": {\"product_data\": [{\"product_name\": \"Smart eVision\", \"version\": {\"version_data\": [{\"version_affected\": \"=\", \"version_value\": \"2022.02.21\"}]}}]}, \"vendor_name\": \"Smart eVision Information Technology Inc.\"}]}}, \"data_format\": \"MITRE\", \"data_type\": \"CVE\", \"data_version\": \"4.0\", \"description\": {\"description_data\": [{\"lang\": \"eng\", \"value\": \"smart eVision has inadequate authorization for system information query function. An unauthenticated remote attacker, who is not explicitly authorized to access the information, can access sensitive information.\"}]}, \"generator\": {\"engine\": \"Vulnogram 0.0.9\"}, \"impact\": {\"cvss\": {\"attackComplexity\": \"LOW\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"NONE\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"scope\": \"UNCHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\", \"version\": \"3.1\"}}, \"problemtype\": {\"problemtype_data\": [{\"description\": [{\"lang\": \"eng\", \"value\": \"CWE-200 Information Exposure\"}]}]}, \"references\": {\"reference_data\": [{\"name\": \"https://www.twcert.org.tw/tw/cp-132-6567-01fa3-1.html\", \"refsource\": \"MISC\", \"url\": \"https://www.twcert.org.tw/tw/cp-132-6567-01fa3-1.html\"}]}, \"solution\": [{\"lang\": \"en\", \"value\": \"Contact tech support from Smart eVision Information Technology Inc.\"}], \"source\": {\"advisory\": \"TVN-202209003\", \"discovery\": \"EXTERNAL\"}}}, \"adp\": [{\"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-03T11:10:32.291Z\"}, \"title\": \"CVE Program Container\", \"references\": [{\"tags\": [\"x_refsource_MISC\", \"x_transferred\"], \"url\": \"https://www.twcert.org.tw/tw/cp-132-6567-01fa3-1.html\"}]}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-39030\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-05-21T14:52:41.223965Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-05-21T14:52:44.989Z\"}}]}",
"cveMetadata": "{\"assignerOrgId\": \"cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e\", \"assignerShortName\": \"twcert\", \"cveId\": \"CVE-2022-39030\", \"datePublished\": \"2022-09-28T03:25:36.185Z\", \"dateReserved\": \"2022-08-30T00:00:00.000Z\", \"dateUpdated\": \"2025-05-21T14:52:48.240Z\", \"state\": \"PUBLISHED\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…