CVE-2022-2336

moderate-risk
Published 2022-08-17

Softing Secure Integration Server, edgeConnector, and edgeAggregator software ships with the default administrator credentials as `admin` and password as `admin`. This allows Softing to log in to the server directly to perform administrative functions. Upon installation or upon first login, the application does not ask the user to change the `admin` password. There is no warning or prompt to ask the user to change the default password, and to change the password, many steps are required.

Do I need to act?

-
0.24% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (6)

Edgeaggregator
Edgeconnector
Opc
Opc Ua C\+\+ Software Development Kit

Affected Vendors

Softing

References (4)

Mitigation https://industrial.softing.com/fileadmin/psirt/downloads/syt-2022-6.html
Third Party Advisory https://www.cisa.gov/uscert/ics/advisories/icsa-22-228-04
Mitigation https://industrial.softing.com/fileadmin/psirt/downloads/syt-2022-6.html
Third Party Advisory https://www.cisa.gov/uscert/ics/advisories/icsa-22-228-04
46
/ 100
moderate-risk
Severity 32/34 · Critical
Exploitability 1/34 · Minimal
Exposure 13/34 · Low