title: CVE-2022-41989
description: Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 does not validate the length of RTLS report payloads during communication. This allows an attacker to send an exceedingly long payload, resulting in an out-of-bounds write to cause a denial-of-service condition or code execution.
problem types: CWE-787 Out-of-bounds Write
affected:
{
defaultStatus: unaffected
product: RTLS Studio
vendor: Sewio
versions:
lessThanOrEqual: 2.6.2, status: affected, version: 2.0.0, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
workarounds: Sewio also recommends the following workarounds to reduce the risk of exploitation:
*  Minimize network exposure for all control system devices and/or systems, and ensure they are  not accessible from the internet https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01 .
*  Locate control system networks and remote devices behind firewalls and isolate them from business networks.