CVE-2022-38100:
Remote attacker can crash CMS8000 devices by sending malformed UDP data, causing a reboot and potentially triggering a mass denial-of-service via UDP broadcast on all connected devices.
Score
A numerical rating that indicates how dangerous this vulnerability is.
7.5High- Published Date:Sep 13, 2022
- CISA KEV Date:*No Data*
- Industries Affected:20
Threat Predictions
- EPSS Score:0.1
- EPSS Percentile:26%
Exploitability
- Score:3.9
- Attack Vector:NETWORK
- Attack Complexity:LOW
- Privileges Required:NONE
- User Interaction:NONE
- Scope:UNCHANGED
Impact
- Score:3.6
- Confidentiality Impact:NONE
- Integrity Impact:NONE
- Availability Impact:HIGH
Description Preview
Remote attacker can crash CMS8000 devices by sending malformed UDP data, causing a reboot and potentially triggering a mass denial-of-service via UDP broadcast on all connected devices.
Overview
The vulnerability arises from the CMS8000 device’s handling of malformed UDP network data, which can be exploited by a remote attacker to crash the device and necessitate a physical reboot. In addition, a UDP broadcast can cause a broader denial-of-service impact across multiple devices on the same network. The issue carries a high impact to availability and is unprivileged, requiring no user interaction. Mitigation efforts from the vendor were not provided in the advisory, and workarounds exist but may require vendor collaboration to implement effectively.
Remediation
- Implement vendor-provided mitigations as a priority:
- Disable UART functionality at the CPU level where possible.
- Enforce unique device authentication before granting access to terminals or bootloaders.
- Enable secure boot where the device supports it.
- Use tamper-evident seals on the device casing to detect unauthorized access.
- If vendor mitigations are not available or incomplete:
- Segment the affected CMS8000 devices on isolated networks or VLANs to limit exposure.
- Restrict UDP traffic to devices from trusted subnets and disable UDP broadcast where feasible.
- Monitor for anomalous UDP traffic targeting these devices and implement network-based anomaly detection.
- Review and harden management access controls; disable unnecessary remote management interfaces.
- Contact Contec Health for updated firmware or official mitigations and apply any available patches promptly.
References
Industries Affected
Below is a list of industries most commonly impacted or potentially at risk based on intelligence.
