CVE-2022-22512

published 2023-03-23

CVE-2022-22512: Hard-coded credentials in Web-UI of multiple VARTA Storage products in multiple versions allows an unauthorized attacker to gain administrative access to the…

Priority P2 60 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

Hard-coded credentials in Web-UI of multiple VARTA Storage products in multiple versions allows an unauthorized attacker to gain administrative access to the Web-UI via network.

Affected

17 ranges

Vendor	Product	Version range	Fixed in
varta	element_backup_firmware	< f21000400	f21000400
varta	element_s1_firmware	< 2e.3.8.0	2e.3.8.0
varta	element_s2_firmware	< 2e.3.8.0	2e.3.8.0
varta	element_s3_firmware	< 2e.3.8.0	2e.3.8.0
varta	element_s3_firmware	>= 2e.4.0.0 < 2e.4.4.0	2e.4.4.0
varta	element_s4_firmware	< d21010400	d21010400
varta	one_l_firmware	< 2e.3.8.0	2e.3.8.0
varta	one_xl_firmware	< 2e.3.8.0	2e.3.8.0
varta	pulse_firmware	< c21010800	c21010800
varta_storage	element_backup	< F21000400	F21000400
varta_storage	element_s1	< 2e.3.8.0	2e.3.8.0
varta_storage	element_s2	< 2e.3.8.0	2e.3.8.0
varta_storage	element_s3	< 2e.3.8.0	2e.3.8.0
varta_storage	element_s3	< 2e.4.4.0	2e.4.4.0
varta_storage	element_s4	< D21010400	D21010400
varta_storage	one_l_xl	< 2e.3.8.0	2e.3.8.0
varta_storage	pulse	< C21010800	C21010800

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-798