Skip to content
OpenAdvisories
Critical ICSA-23-012-01 9 CVEs

Sewio RTLS Studio

Published Jan 12, 2023 · Updated Jan 12, 2023

Vendor: Sewio Product: RTLS Studio

Summary

Successful exploitation of these vulnerabilities could allow an attacker to obtain unauthorized access to the server, alter information, create a denial-of-service condition, gain escalated privileges, and execute arbitrary code.

Vulnerabilities 9

  • Critical 10.0
    CVE-2022-45444

    CVE-2022-45444

    Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 contains hard-coded passwords for select users in the application’s database. This could allow a remote attacker to login to the database with unrestricted access.

    Sewio RTLS Studio
  • Critical 9.1
    CVE-2022-43483

    CVE-2022-43483

    Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 does not properly validate the input module name to the monitor services of the software. This could allow a remote attacker to access sensitive functions of the a…

    Sewio RTLS Studio
  • Critical 9.1
    CVE-2022-47911

    CVE-2022-47911

    Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 does not properly validate the input module name to the backup services of the software. This could allow a remote attacker to access sensitive functions of the ap…

    Sewio RTLS Studio
  • Critical 9.0
    CVE-2022-41989

    CVE-2022-41989

    Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 does not validate the length of RTLS report payloads during communication. This allows an attacker to send an exceedingly long payload, resulting in an out-of-boun…

    Sewio RTLS Studio
  • High 8.1
    CVE-2022-45127

    CVE-2022-45127

    Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 is vulnerable to cross-site request forgery in its backup services. An attacker could take advantage of this vulnerability to execute arbitrary backup operations a…

    Sewio RTLS Studio
  • High 8.1
    CVE-2022-47395

    CVE-2022-47395

    Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 is vulnerable to cross-site request forgery in its monitor services. An attacker could take advantage of this vulnerability to execute arbitrary maintenance operat…

    Sewio RTLS Studio
  • Medium 6.8
    CVE-2022-47917

    CVE-2022-47917

    Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 is vulnerable to improper input validation of user input to several modules and services of the software. This could allow an attacker to delete arbitrary files an…

    Sewio RTLS Studio
  • Medium 6.3
    CVE-2022-46733

    CVE-2022-46733

    Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 is vulnerable to cross-site scripting in its backup services. An attacker could take advantage of this vulnerability to execute arbitrary commands.

    Sewio RTLS Studio
  • Medium 5.5
    CVE-2022-43455

    CVE-2022-43455

    Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 is vulnerable to improper input validation of user input to the service_start, service_stop, and service_restart modules of the software. This could allow an attac…

    Sewio RTLS Studio

Revision history

  1. #1

    Publication Date

References