CRITICAL🇵🇱 Wersja polska

CVE-2022-2336

CVSS 9.8v3.1pub. 2022-08-17upd. 2024-11-21

Softing Secure Integration Server, edgeConnector, and edgeAggregator software ships with the default administrator credentials as `admin` and password as `admin`. This allows Softing to log in to the server directly to perform administrative functions. Upon installation or upon first login, the application does not ask the user to change the `admin` password. There is no warning or prompt to ask the user to change the default password, and to change the password, many steps are required.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Softing Edgeaggregator

    APP
    Softing
    3.1

  • Softing Edgeconnector

    APP
    Softing
    3.1

  • Softing Opc

    APP
    Softing
    5.2

  • Softing Opc Ua C\+\+ Software Development Kit

    APP
    Softing
    6

  • Softing Secure Integration Server

    APP
    Softing
    1.22

  • Softing Uagates

    APP
    Softing
    1.74
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Auth Bypass
CWE
References

Related vulnerabilities

CVE-2023-27335CRITICAL9.6PL ✓ten sam produkt

Softing edgeAggregator: XSS umożliwiający RCE z uprawnieniami root

CVE-2020-14524CRITICAL9.8ten sam produkt

Softing Industrial Automation all versions prior to the latest build of version 4.47.0, The affected product i...

CVE-2023-27334HIGH7.5ten sam produkt

Softing edgeConnector Siemens ConditionRefresh Resource Exhaustion Denial-of-Service Vulnerability. This vulne...

CVE-2023-27336HIGH7.5ten sam produkt

Softing edgeConnector Siemens OPC UA Server Null Pointer Dereference Denial-of-Service Vulnerability. This vul...

CVE-2023-38125HIGH8.8ten sam produkt

Softing edgeAggregator Permissive Cross-domain Policy with Untrusted Domains Remote Code Execution Vulnerabili...