by Kastro
Paper/Archive/CVE-2022-2336

CVE-2022-2336

Softing Secure Integration Server — Softing Secure Integration Server Improper Authentication

EPSS 1%CVSS 9.8
critical.is priorityof 100
42
CVSS 9.8 (NVD, CNA agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 64.2.642 × 2012.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Softing Secure Integration Server, edgeConnector, and edgeAggregator software ships with the default administrator credentials as `admin` and password as `admin`. This allows Softing to log in to the server directly to perform administrative functions. Upon installation or upon first login, the application does not ask the user to change the `admin` password. There is no warning or prompt to ask the user to change the default password, and to change the password, many steps are required.

Affected

ProductAffectedFixed inSource
Secure Integration ServerV1.22–CNA
edgeConnector SiemensV3.10–CNA
edgeConnector 840DV3.10–CNA
edgeConnector ModbusV3.10–CNA
edgeAggregatorV3.10–CNA

Scores by source

icscert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcisa.gov/uscert/ics/advisories/icsa-22-228-04refindustrial.softing.com/fileadmin/psirt/downloads/syt-2022-6.html