CVE-2022-22809 is a Missing Authentication for Critical Function vulnerability (CWE-306) affecting Schneider Electric's spaceLYnk, Wiser for KNX (formerly homeLYnk), and fellerLYnk products (all versions V2.6.2 and prior). This flaw allows an unauthenticated attacker to modify touch configurations, potentially disrupting building automation systems. Rated with a CVSS score of 5.3 (Medium), the vulnerability is network-exploitable with low attack complexity and requires no user interaction (AV:N/AC:L/UI:N). The potential impact is limited to unauthorized modification of configurations (I:L), with no confidentiality or availability impact (C:N/A:N). Currently, there is no evidence of active exploitation, and no public exploit code is available in Metasploit, Nuclei, or ExploitDB. Despite the lack of active exploitation, the vulnerability has garnered some community attention with two mentions and two media articles, indicating awareness within the cybersecurity community.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 2.6.2CPE matchmatch criteria | cpe:2.3:o:schneider-electric:spacelynk_firmware:*:*:*:*:*:*:*:* | ||
<= 2.6.2CPE matchmatch criteria | cpe:2.3:o:schneider-electric:wiser_for_knx_firmware:*:*:*:*:*:*:*:* | ||
<= 2.6.2CPE matchmatch criteria | cpe:2.3:o:schneider-electric:fellerlynk_firmware:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.