CVE-2022-38121: UPSMON PRO configuration file stores user password in plaintext under public user directory. A remote attacker with general user privilege can access all…

PriorityP346medium6.5CVSS 3.1

AVNACLPRLUINSUCHINAN

EXPLOIT

EPSS

3.38%

87.3th percentile

UPSMON PRO configuration file stores user password in plaintext under public user directory. A remote attacker with general user privilege can access all users‘ and administrators' account names and passwords via this unprotected configuration file.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
powercom_co_ltd	upsmon_pro	—	—
upspowercom	upsmon_pro	—	—

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.