Vulnerability Details CVE-2022-40187
Foresight GC3 Launch Monitor 1.3.15.68 ships with a Target Communication Framework (TCF) service enabled. This service listens on a TCP port on all interfaces and allows for process debugging, file system modification, and terminal access as the root user. In conjunction with a hosted wireless access point and the known passphrase of FSSPORTS, an attacker could use this service to modify a device and steal intellectual property.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 11.4%
CVSS Severity
CVSS v3 Score 8.0
References
- https://github.com/atredispartners/advisories/blob/master/ATREDIS-2022-0003.md
- https://wiki.eclipse.org/TCF
- https://www.bushnellgolf.com/products/launch-monitors/launch-pro/
- https://www.foresightsports.com/gc3
- https://github.com/atredispartners/advisories/blob/master/ATREDIS-2022-0003.md
- https://wiki.eclipse.org/TCF
- https://www.bushnellgolf.com/products/launch-monitors/launch-pro/
- https://www.foresightsports.com/gc3
Products affected by CVE-2022-40187
-
cpe:2.3:h:bushnellgolf:launch_pro:-
-
cpe:2.3:h:foresightsports:gc3_launch_monitor:-
-
cpe:2.3:o:bushnellgolf:launch_pro_firmware:*
-
cpe:2.3:o:foresightsports:gc3_launch_monitor_firmware:*