← Back to CVEs

CVE-2022-2336

CRITICAL

9.8

Description

Softing Secure Integration Server, edgeConnector, and edgeAggregator software ships with the default administrator credentials as `admin` and password as `admin`. This allows Softing to log in to the server directly to perform administrative functions. Upon installation or upon first login, the application does not ask the user to change the `admin` password. There is no warning or prompt to ask the user to change the default password, and to change the password, many steps are required.

CVE Details

CVSS v3.1 Score9.8

SeverityCRITICAL

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published8/17/2022

Last Modified11/21/2024

Sourcenvd

Honeypot Sightings0

Affected Products

softing:edgeaggregatorsofting:edgeconnectorsofting:opcsofting:opc_ua_c\+\+_software_development_kitsofting:secure_integration_serversofting:uagates

Weaknesses (CWE)

CWE-287

References

https://industrial.softing.com/fileadmin/psirt/downloads/syt-2022-6.html(ics-cert@hq.dhs.gov)

https://www.cisa.gov/uscert/ics/advisories/icsa-22-228-04(ics-cert@hq.dhs.gov)

https://industrial.softing.com/fileadmin/psirt/downloads/syt-2022-6.html(af854a3a-2127-422b-91ae-364da2661108)

https://www.cisa.gov/uscert/ics/advisories/icsa-22-228-04(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.