Paper/Archive/CVE-2022-3485

CVE-2022-3485

ifm moneo appliance — Weak Password Recovery in ifm moneo appliance

CVSS 9.8 (CNA)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 62.5.625 × 2012.5 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

In IFM Moneo Appliance with version up to 1.9.3 an unauthenticated remote attacker can reset the administrator password by only supplying the serial number and thus gain full control of the device.

Affected

ProductAffectedFixed inSource

moneo appliance≤ 1.9.3–CNA

Scores by source

CERTVDE (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcert.vde.com/en/advisories/VDE-2022-050