Paper/Archive/CVE-2022-22512

CVE-2022-22512

VARTA Storage Element backup — VARTA: Multiple devices prone to hard-coded credentials

CVSS 9.8 (CNA)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 52.2.522 × 2010.4 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Hard-coded credentials in Web-UI of multiple VARTA Storage products in multiple versions allows an unauthorized attacker to gain administrative access to the Web-UI via network.

Affected

ProductAffectedFixed inSource

Element backup< F21000400F21000400CNA

Element S1< 2e.3.8.02e.3.8.0CNA

Element S2< 2e.3.8.02e.3.8.0CNA

Element S3< 2e.3.8.02e.3.8.0CNA

Element S3< 2e.4.4.02e.4.4.0CNA

Element S4< D21010400D21010400CNA

One L/XL< 2e.3.8.02e.3.8.0CNA

Pulse (not pulse neo)< C21010800C21010800CNA

Scores by source

CERTVDE (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcert.vde.com/en/advisories/VDE-2022-061