What is CVE-2022-22309?

CVE-2022-22309 is a medium-severity vulnerability in Ibm Power_system_s922, classified under Missing Authentication for Critical Function. CVSS score: 6.8/10. Published 2022-05-24.

How severe is CVE-2022-22309?

Medium severity. CVSS v3 base score is 6.8 out of 10.

Auth bypass in Ibm Power_system_s922

CVE-2022-22309

The POWER systems FSP is vulnerable to unauthenticated logins through the serial port/TTY interface. This vulnerability can be more critical if the serial port is connected to a serial-over-lan device. IBM X-Force ID: 217095.

Vulnerability class: Broken Authentication

EPSS: 0.002 (15.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Ibm Power_system_s922
Ibm Power_system_s922_firmware
Ibm Power System S922 Server — versions FW940, FW950

Weakness classification (CWE)

CWE-306 — Missing Authentication for Critical Function

References

psirt@us.ibm.com (x_refsource_CONFIRM, Vendor Advisory)
psirt@us.ibm.com (VDB Entry, vdb-entry, Vendor Advisory, x_refsource_XF)

Frequently asked questions

What is CVE-2022-22309?: CVE-2022-22309 is a medium-severity vulnerability in Ibm Power_system_s922, classified under Missing Authentication for Critical Function. CVSS score: 6.8/10. Published 2022-05-24.
How severe is CVE-2022-22309?: Medium severity. CVSS v3 base score is 6.8 out of 10.