title: CVE-2022-47917
description: Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 is vulnerable to improper input validation of user input to several modules and services of the software. This could allow an attacker to delete arbitrary files and cause a denial-of-service condition.
problem types: CWE-20 Improper Input Validation
affected:
{
defaultStatus: unaffected
product: RTLS Studio
vendor: Sewio
versions:
lessThanOrEqual: 2.6.2, status: affected, version: 2.0.0, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: Sewio has provided the following updates and recommends that users update to the latest version:
*  RTLS Studio: Update to  version 3.0.0 or later https://portal.sewio.net/login  (requires login)
workarounds: Sewio also recommends the following workarounds to reduce the risk of exploitation:
*  Minimize network exposure for all control system devices and/or systems, and ensure they are  not accessible from the internet https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01 .
*  Locate control system networks and remote devices behind firewalls and isolate them from business networks.