CVE-2022-29898

9.1 criticalEPSS 0.7%

Critical (9.1) in phoenixcontact. EPSS 0.7% chance of exploitation in the next 30 days.

On various RAD-ISM-900-EN-* devices by PHOENIX CONTACT an admin user could use the configuration file uploader in the WebUI to execute arbitrary code with root privileges on the OS due to an improper validation of an integrity check value in all versions of the firmware.

Severity

CVSS 3.1

9.1 critical

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 51% of CVEs (scores of 2026-10-31)
CWE: CWE-354
Published: 2022-05-11
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

phoenixcontact:rad-ism-900-en-bd-bus_firmware
phoenixcontact:rad-ism-900-en-bd\/b_firmware
phoenixcontact:rad-ism-900-en-bd_firmware

References

https://cert.vde.com/en/advisories/VDE-2022-018/
https://cert.vde.com/en/advisories/VDE-2022-018/

Check your stack JSON