CVE-2022-25804

low-risk
Published 2022-06-09

An issue was discovered in the IGEL Universal Management Suite (UMS) 6.07.100. Insecure permissions for the serverconfig registry key (under JavaSoft\Prefs\de\igel\rm\config in HKEY_LOCAL_MACHINE\SOFTWARE) allow an unprivileged local attacker to read the encrypted dbuser and dbpassword values for the UMS superuser.

Do I need to act?

-
0.03% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.5/10 Medium
LOCAL / LOW complexity

Affected Products (1)

Universal Management Suite

Affected Vendors

Igel

References (4)

Exploit https://github.com/atredispartners/advisories/blob/master/ATREDIS-2022-0002.md
Product https://www.igel.com/igel-solution-family/universal-management-suite/
Exploit https://github.com/atredispartners/advisories/blob/master/ATREDIS-2022-0002.md
Product https://www.igel.com/igel-solution-family/universal-management-suite/
23
/ 100
low-risk
Severity 18/34 · Moderate
Exploitability 0/34 · Minimal
Exposure 5/34 · Minimal