Risk | Low |
Patch available | NO |
Number of vulnerabilities | 9 |
CVE-ID | CVE-2022-1739 CVE-2022-1740 CVE-2022-1741 CVE-2022-1742 CVE-2022-1743 CVE-2022-1744 CVE-2022-1745 CVE-2022-1746 CVE-2022-1747 |
CWE-ID | CWE-347 CWE-1283 CWE-912 CWE-20 CWE-22 CWE-250 CWE-290 CWE-266 CWE-346 |
Exploitation vector | Local |
Public exploit | N/A |
Vulnerable software Subscribe |
ImageCast X Hardware solutions / Other hardware appliances |
Vendor | Dominion Voting Systems |
Security Bulletin
This security bulletin contains information about 9 vulnerabilities.
EUVDB-ID: #VU63987
Risk: Low
CVSSv3.1: 6.1 [CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:U/RC:C]
CVE-ID: CVE-2022-1739
CWE-ID:
CWE-347 - Improper Verification of Cryptographic Signature
Exploit availability: No
DescriptionThe vulnerability allows a local user to compromise the target system.
The vulnerability exists due to the affected application does not validate application signatures to a trusted root certificate. An authenticated attacker with physical access can install malicious code.
MitigationCybersecurity Help is currently unaware of any official solution to address this vulnerability.
Vulnerable software versionsImageCast X: 5.5.10.30 - 5.5.10.32
External linkshttp://ics-cert.us-cert.gov/advisories/icsa-22-154-01
Q & A
Can this vulnerability be exploited remotely?
No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU63991
Risk: Low
CVSSv3.1: 3.8 [CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:U/RL:U/RC:C]
CVE-ID: CVE-2022-1740
CWE-ID:
CWE-1283 - Mutable Attestation or Measurement Reporting Data
Exploit availability: No
DescriptionThe vulnerability allows a local user to compromise the target system.
The vulnerability exists due to the ImageCast X’s on-screen application hash display feature, audit log export, and application export functionality rely on self-attestation mechanisms. An authenticated attacker with physical access can disguise malicious applications on a device.
MitigationCybersecurity Help is currently unaware of any official solution to address this vulnerability.
Vulnerable software versionsImageCast X: 5.5.10.30 - 5.5.10.32
External linkshttp://ics-cert.us-cert.gov/advisories/icsa-22-154-01
Q & A
Can this vulnerability be exploited remotely?
No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU63992
Risk: Low
CVSSv3.1: 6.1 [CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:U/RC:C]
CVE-ID: CVE-2022-1741
CWE-ID:
CWE-912 - Hidden Functionality (Backdoor)
Exploit availability: No
DescriptionThe vulnerability allows a local user to compromise vulnerable system
The vulnerability exists due to hidden functionality (backdoor) is present in software within the Terminal Emulator application. An authenticated attacker with physical access can use this functionality to gain elevated privileges on the device and install malicious code.
MitigationCybersecurity Help is currently unaware of any official solution to address this vulnerability.
Vulnerable software versionsImageCast X: 5.5.10.30 - 5.5.10.32
External linkshttp://ics-cert.us-cert.gov/advisories/icsa-22-154-01
Q & A
Can this vulnerability be exploited remotely?
No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU63993
Risk: Low
CVSSv3.1: 6.1 [CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:U/RC:C]
CVE-ID: CVE-2022-1742
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a local user to compromise the target system.
The vulnerability exists due to the affected application allows for rebooting into Android Safe Mode. An authenticated attacker with physical access can directly access the operating system, escalate privileges on a device and install malicious code.
MitigationCybersecurity Help is currently unaware of any official solution to address this vulnerability.
Vulnerable software versionsImageCast X: 5.5.10.30 - 5.5.10.32
External linkshttp://ics-cert.us-cert.gov/advisories/icsa-22-154-01
Q & A
Can this vulnerability be exploited remotely?
No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU63994
Risk: Low
CVSSv3.1: 6.1 [CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:U/RC:C]
CVE-ID: CVE-2022-1743
CWE-ID:
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Exploit availability: No
DescriptionThe vulnerability allows a local user to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences. An authenticated attacker with physical access can send a specially crafted election definition file and execute arbitrary code on the system.
MitigationCybersecurity Help is currently unaware of any official solution to address this vulnerability.
Vulnerable software versionsImageCast X: 5.5.10.30 - 5.5.10.32
External linkshttp://ics-cert.us-cert.gov/advisories/icsa-22-154-01
Q & A
Can this vulnerability be exploited remotely?
No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU63995
Risk: Low
CVSSv3.1: 6.1 [CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:U/RC:C]
CVE-ID: CVE-2022-1744
CWE-ID:
CWE-250 - Execution with Unnecessary Privileges
Exploit availability: No
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to application binary has a setuid bit. An authenticated attacker with physical access can run the affected binary and execute arbitrary code on the system with root privileges.
MitigationCybersecurity Help is currently unaware of any official solution to address this vulnerability.
Vulnerable software versionsImageCast X: 5.5.10.30 - 5.5.10.32
External linkshttp://ics-cert.us-cert.gov/advisories/icsa-22-154-01
Q & A
Can this vulnerability be exploited remotely?
No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU63996
Risk: Low
CVSSv3.1: 6.1 [CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:U/RC:C]
CVE-ID: CVE-2022-1745
CWE-ID:
CWE-290 - Authentication Bypass by Spoofing
Exploit availability: No
DescriptionThe vulnerability allows a local user to bypass authentication process.
The vulnerability exists due to the authentication mechanism susceptible to forgery. An authenticated attacker with physical access can gain administrative privileges on a device and install malicious code.
MitigationCybersecurity Help is currently unaware of any official solution to address this vulnerability.
Vulnerable software versionsImageCast X: 5.5.10.30 - 5.5.10.32
External linkshttp://ics-cert.us-cert.gov/advisories/icsa-22-154-01
Q & A
Can this vulnerability be exploited remotely?
No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU63997
Risk: Low
CVSSv3.1: 6.1 [CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:U/RC:C]
CVE-ID: CVE-2022-1746
CWE-ID:
CWE-266 - Incorrect Privilege Assignment
Exploit availability: No
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to the authentication mechanism used by poll workers to administer voting can expose cryptographic secrets used to protect election information. An authenticated attacker with physical access can gain access to sensitive information and perform privileged actions.
MitigationCybersecurity Help is currently unaware of any official solution to address this vulnerability.
Vulnerable software versionsImageCast X: 5.5.10.30 - 5.5.10.32
External linkshttp://ics-cert.us-cert.gov/advisories/icsa-22-154-01
Q & A
Can this vulnerability be exploited remotely?
No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU63999
Risk: Low
CVSSv3.1: 4 [CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:U/RC:C]
CVE-ID: CVE-2022-1747
CWE-ID:
CWE-346 - Origin Validation Error
Exploit availability: No
DescriptionThe vulnerability allows a local user to compromise the target system.
The vulnerability exists due to the authentication mechanism used by voters to activate a voting session is susceptible to forgery. An authenticated attacker with physical access can print an arbitrary number of ballots without authorization.
MitigationCybersecurity Help is currently unaware of any official solution to address this vulnerability.
Vulnerable software versionsImageCast X: 5.5.10.30 - 5.5.10.32
External linkshttp://ics-cert.us-cert.gov/advisories/icsa-22-154-01
Q & A
Can this vulnerability be exploited remotely?
No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.