Skip to content
OpenAdvisories
High VDE-2022-049 2 CVEs

TRUMPF: Multiple products prone to X.Org server vulnerabilities

Published Nov 7, 2022 · Updated May 22, 2025 · Revision 2

Vendor: TRUMPF Product: TruControl in redpowerDirect Product: TruControl in TruDiode Product: TruControl in TruDisk Product: TruControl in TruFiber Product: TruControl in TruMicro2000 Product: TruControl in TruMicro5000 Product: TruControl in TruMicro6000 Product: TruControl in TruMicro7000 Product: TruControl in TruMicro8000 Product: TruControl in TruMicro9000 Product: TruControl in TruPulse

Summary

TruControl laser control software from versions 1.60.0 to 3.40.0 use a vulnerable  X.Org server versions. The affected X.Org vulnerability is not validating the request length properly for the handler 'ProcXkbSetGeometry'. An authenticated Attacker could craft a request which could lead to memory out-of bounds write.

Details

Impact
When logged on to the system the privilege escalation vulnerability can be exploited with following possible impacts/damages to the system:

- Data loss in the laser control
- Standstill of production
- Damage by change of the laser control

Safety is not affected since it is controlled by an independent electromechanical safety mechanism.

Remote Code Execution as one of the mentioned impacts in the vulnerability description of CVE-2022-2320 is not possible since no SSH Forwarding is used.

Mitigation
Securing the access to the production network.
Please contact your service partner (service.tls@trumpf.com) for instructions on how to get automatically informed for the new major release 3.42.0 of the new TruControl software version.

Remediation
Retrieve instructions on how to deactivate the ssh access or activate the firewall on port 22 (SSH) of your laser.

Vulnerabilities 2

Revision history

  1. #2

    Fix: quotation mark

  2. #1

    Initial revision.

References