CVE-2022-29897

9.1 criticalEPSS 1.4%

Critical (9.1) in phoenixcontact. EPSS 1.4% chance of exploitation in the next 30 days.

On various RAD-ISM-900-EN-* devices by PHOENIX CONTACT an admin user could use the traceroute utility integrated in the WebUI to execute arbitrary code with root privileges on the OS due to an improper input validation in all versions of the firmware.

Severity

CVSS 3.1

9.1 critical

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

EPSS: 1.4% chance of exploitation in the next 30 days; higher than 71% of CVEs (scores of 2026-10-31)
CWE: CWE-20
Published: 2022-05-11
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

phoenixcontact:rad-ism-900-en-bd-bus_firmware
phoenixcontact:rad-ism-900-en-bd\/b_firmware
phoenixcontact:rad-ism-900-en-bd_firmware

References

https://cert.vde.com/en/advisories/VDE-2022-018/
https://cert.vde.com/en/advisories/VDE-2022-018/

Check your stack JSON