CVE-2022-4636

Black Box KVM Firmware version 3.4.31307 on models ACR1000A-R-R2, ACR1000A-T-R2, ACR1002A-T, ACR1002A-R, and ACR1020A-T is vulnerable to…

High7.5EPSS 0.89%

Published: 10 Jan 2023
Updated: 16 Jan 2025
Reserved: 21 Dec 2022
Assigned by: icscert

Description

Black Box KVM Firmware version 3.4.31307 on models ACR1000A-R-R2, ACR1000A-T-R2, ACR1002A-T, ACR1002A-R, and ACR1020A-T is vulnerable to path traversal, which may allow an attacker to steal user credentials and other sensitive information through local file inclusion.

Scores

CVSS scores of CVE-2022-4636, by who scored it
Scored by	CVSS	Score	Vector
icscertCNA (assigner)	3.1	High7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVDNVD · Modified	3.1	High7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS (exploitation in 30 days): 0.89% · top 40% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Weakness

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (opens in a new tab)All about CWE-22 and its CVEs

Affected products

Black Box · KVM ACR1020A-T
- affected 3.4.31307
Black Box · KVM ACR1002A-R
- affected 3.4.31307
Black Box · KVM ACR1002A-T
- affected 3.4.31307
Black Box · KVM ACR1000A-T-R2
- affected 3.4.31307
Black Box · KVM ACR1000A-R-R2
- affected 3.4.31307

References (1)

https://www.cisa.gov/uscert/ics/advisories/icsa-23-010-01 (opens in a new tab)government-resourcex_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2022-4636](https://trackcve.app/badge/CVE-2022-4636.svg)](https://trackcve.app/cve/CVE-2022-4636)

Record last updated 16 Jan 2025, 22:02 UTC.