CVE-2022-3682

CVE-2022-3682 describes a critical vulnerability in Hitachi Energy SDM600 versions prior to 1.2 FP3 HF4 (Build Nr. 1.2.23000.291). This flaw, categorized as CWE-434 (Unrestricted Upload of File with Dangerous Type), allows an authenticated attacker to upload a specially crafted message to the system node due to improper file permission validation. This could lead to arbitrary code execution, granting the attacker full control over the system. The vulnerability carries a high CVSS v3.1 score of 8.8, indicating a significant risk. Its attack vector is network-based with low attack complexity and requires low privileges, but no user interaction is needed. Successful exploitation could result in high impacts to confidentiality, integrity, and availability. Currently, there is no evidence of active exploitation in the wild, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. While the EPSS score is low, indicating a low probability of exploitation, there is some community discussion, with one mention noting its potential for remote control.