Read the docs
TI-2022-02982 Aliases CVE-2022-3228GHSA-cqc5-vhj7-6mrq

Stack-based buffer overflow in Host Engineering H0-ECOM100 Communications Module

Priority LOW 29CWE-121Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.

Summary

Using custom code, an attacker can write into name or description fields larger than the appropriate buffer size causing a stack-based buffer overflow on Host Engineering H0-ECOM100 Communications Module Firmware versions v5.0.155 and prior. This may allow an attacker to crash the affected device or cause it to become unresponsive.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00349 28th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Host EngineeringH0-ECOM100 Communications ModuleAll versions – Firmware v5.0.155—No fix listedCNA
  • H0-ECOM100 Communications Module VendorHost Engineering Affected All versions – Firmware v5.0.155 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:hosteng:h0-ecom100_firmware:*:*:*:*:*:*:*:*before 5.0.156VulnerableHosteng
cpe:2.3:h:hosteng:h0-ecom100:-:*:*:*:*:*:*:*not specified by NVDRunning onHosteng
  • cpe:2.3:o:hosteng:h0-ecom100_firmware:*:*:*:*:*:*:*:* Versions before 5.0.156 Vulnerable ·Hosteng
  • cpe:2.3:h:hosteng:h0-ecom100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hosteng

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-3228
  2. 2026-10-03 Alias added: GHSA-cqc5-vhj7-6mrq

References

Advisory 1

  • TI-2020-15437 Improper input validation in Host Engineering H0-ECOM100 Module CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences