Foresight GC3 Launch Monitor 1.3.15.68 ships with a Target Communication Framework (TCF)…
Key facts
- Attack vector
- Adjacent network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.
Summary
Foresight GC3 Launch Monitor 1.3.15.68 ships with a Target Communication Framework (TCF) service enabled. This service listens on a TCP port on all interfaces and allows for process debugging, file system modification, and terminal access as the root user. In conjunction with a hosted wireless access point and the known passphrase of FSSPORTS, an attacker could use this service to modify a device and steal intellectual property.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:foresightsports:gc3_launch_monitor_firmware:*:*:*:*:*:*:*:* | before 1.5.0.2 | Vulnerable | Foresightsports |
| cpe:2.3:h:foresightsports:gc3_launch_monitor:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Foresightsports |
| cpe:2.3:o:bushnellgolf:launch_pro_firmware:*:*:*:*:*:*:*:* | before 1.5.0.2 | Vulnerable | Bushnellgolf |
| cpe:2.3:h:bushnellgolf:launch_pro:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Bushnellgolf |
- cpe:2.3:o:foresightsports:gc3_launch_monitor_firmware:*:*:*:*:*:*:*:* Versions before 1.5.0.2 Vulnerable ·Foresightsports
- cpe:2.3:h:foresightsports:gc3_launch_monitor:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Foresightsports
- cpe:2.3:o:bushnellgolf:launch_pro_firmware:*:*:*:*:*:*:*:* Versions before 1.5.0.2 Vulnerable ·Bushnellgolf
- cpe:2.3:h:bushnellgolf:launch_pro:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Bushnellgolf
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2022-40187
- 2026-10-03 Alias added: GHSA-7q22-vf3p-qvwp
References
Sources
- CVE-2022-40187 · CVE Program
- CVE-2022-40187 · NVD
- FIRST EPSS
- GHSA-7q22-vf3p-qvwp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences