CVE-2022-2289
mediumpriority · track · 31EPSS 0.013 · 71 %ileDEEURUUSEPSS · scored 2026-10-27
Use After Free in GitHub repository vim/vim prior to 9.0.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- Fixedphoenix_contact_psirt
Update to the latest LTS Firmware Release.Update to the latest LTS PLCnext Engineer Release.Please check Phoenix Contact PSIRT webpage for further Updates of this Advisory.
- Fixedphoenix_contact_psirt
Update to the latest 2023.0.0 LTS Firmware Release. PHOENIX CONTACT recommends to always use an up-to-date version of the PLCnext Engineer.
- Mitigationphoenix_contact_psirt
Phoenix Contact recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to our application note:Measures to protect network-capable devices with Ethernet connection
- Mitigationphoenix_contact_psirt
Phoenix Contact recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to our application note: Measures to protect network-capable devices with Ethernet connection
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.8–7.8
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (47)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- VDE-2022-046PHOENIX CONTACT: Multiple Linux component vulnerabilities in PLCnext Firmware2022-11-10csaf · phoenix_contact_psirtDE
UPDATE A: Two devices (ENERGY AXC PU, SMARTRTU AXC SG) added (24.11.2022) Update for PLCnext Firmware containing fixes for recent vulnerability findings in Linux components and security enhancements. PLCnext Control AXC F x152 is certified according to IEC 62443-4-1 and IEC 62443-4-2. This certification requires that all third-party components used in the firmware are regularly checked for known vulnerabilities.
- VDE-2023-001PHOENIX CONTACT: Multiple Vulnerabilities in PLCnext Firmware2023-02-14csaf · phoenix_contact_psirtDE
A new LTS Firmware release fixes known vulnerabilities in used open-source libraries. In addition, the following improvements have been implemented: HMI - Hardening against DoS attacks. - Hardening against memory leak problems in case of network attacks. WBM - Umlauts in the password of the 'User Manager' were not handled correctly. The password rule for upper and lower case was not followed. This could lead to unintentionally weaker passwords.- Hardening of WBM against Cross-Site-Scripting. User Manager - In security notifications 'SecurityToken' was always displayed as '0000000' when creating or modifying users.- Hardening of Trust and Identity Stores.
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (23)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2022-2289/cnnvd
- https://github.com/vim/vimPatchcnnvd
- https://github.com/vim/vim/commit/c5274dd12224421f2430b30c53b881b9403d649ecnnvd
- https://huntr.dev/bounties/7447d2ea-db5b-4883-adf4-1eaf7deace64cnnvd
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/43Y3VJPOTTY3NTREDIFUPITM2POG4ZLP/cnnvd
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UXPO5EHDV6J4B27E65DOQGZFELUFPRSK/cnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2022-2289cnnvd
- https://security.gentoo.org/glsa/202208-32cnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan