CVE-2022-2288
mediumpriority · track · 31EPSS 0.014 · 73 %ileDEEURUUSEPSS · scored 2026-10-27
Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- Fixedphoenix_contact_psirt
Update to the latest LTS Firmware Release.Update to the latest LTS PLCnext Engineer Release.Please check Phoenix Contact PSIRT webpage for further Updates of this Advisory.
- Fixedphoenix_contact_psirt
Update to the latest 2023.0.0 LTS Firmware Release. PHOENIX CONTACT recommends to always use an up-to-date version of the PLCnext Engineer.
- Mitigationphoenix_contact_psirt
Phoenix Contact recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to our application note:Measures to protect network-capable devices with Ethernet connection
- Mitigationphoenix_contact_psirt
Phoenix Contact recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to our application note: Measures to protect network-capable devices with Ethernet connection
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.8–7.8
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (46)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- VDE-2022-046PHOENIX CONTACT: Multiple Linux component vulnerabilities in PLCnext Firmware2022-11-10csaf · phoenix_contact_psirtDE
UPDATE A: Two devices (ENERGY AXC PU, SMARTRTU AXC SG) added (24.11.2022) Update for PLCnext Firmware containing fixes for recent vulnerability findings in Linux components and security enhancements. PLCnext Control AXC F x152 is certified according to IEC 62443-4-1 and IEC 62443-4-2. This certification requires that all third-party components used in the firmware are regularly checked for known vulnerabilities.
- VDE-2023-001PHOENIX CONTACT: Multiple Vulnerabilities in PLCnext Firmware2023-02-14csaf · phoenix_contact_psirtDE
A new LTS Firmware release fixes known vulnerabilities in used open-source libraries. In addition, the following improvements have been implemented: HMI - Hardening against DoS attacks. - Hardening against memory leak problems in case of network attacks. WBM - Umlauts in the password of the 'User Manager' were not handled correctly. The password rule for upper and lower case was not followed. This could lead to unintentionally weaker passwords.- Hardening of WBM against Cross-Site-Scripting. User Manager - In security notifications 'SecurityToken' was always displayed as '0000000' when creating or modifying users.- Hardening of Trust and Identity Stores.
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (20)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2022-2288/cnnvd
- https://github.com/vim/vim/commit/c6fdb15d423df22e1776844811d082322475e48acnnvd
- https://huntr.dev/bounties/a71bdcb7-4e9b-4650-ab6a-fe8e3e9852adcnnvd
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/43Y3VJPOTTY3NTREDIFUPITM2POG4ZLP/cnnvd
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UXPO5EHDV6J4B27E65DOQGZFELUFPRSK/cnnvd
- https://security.gentoo.org/glsa/202208-32cnnvd
- https://security.gentoo.org/glsa/202305-16cnnvd
- https://vigilance.fr/vulnerability/Vim-buffer-overflow-via-parse-command-modifiers-38820cnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan