Lucene search

[email protected]CVE-2022-2052

HistoryOct 17, 2022 - 9:15 a.m.

CVE-2022-2052

2022-10-1709:15:12

CWE-284

[email protected]

web.nvd.nist.gov

trumpf products

default passwords

privileged users

system access

nvd

cve-2022-2052

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.3 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

58.4%

JSON

Multiple Trumpf Products in multiple versions use default privileged Windows users and passwords. An adversary may use these accounts to remotely gain full access to the system.

Affected configurations

NVD

Node

trumpfjob_order_interface

trumpfoseonRange≤1.6

trumpftrutops_boost

trumpftrutops_fab

trumpftrutops_monitor

CPENameOperatorVersion
trumpf:job_order_interfacetrumpf job order interfaceeq*
trumpf:oseontrumpf oseonle1.6
trumpf:trutops_boosttrumpf trutops boosteq*
trumpf:trutops_fabtrumpf trutops fabeq*
trumpf:trutops_monitortrumpf trutops monitoreq*

CPE	Name	Operator	Version
trumpf:job_order_interface	trumpf job order interface	eq	*
trumpf:oseon	trumpf oseon	le	1.6
trumpf:trutops_boost	trumpf trutops boost	eq	*
trumpf:trutops_fab	trumpf trutops fab	eq	*
trumpf:trutops_monitor	trumpf trutops monitor	eq	*

CNA Affected

[
  {
    "vendor": "TRUMPF Werkzeugmaschinen SE + Co. KG",
    "product": "TruTops Monitor",
    "versions": [
      {
        "version": "All Versions",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "TRUMPF Werkzeugmaschinen SE + Co. KG",
    "product": "TruTops Fab",
    "versions": [
      {
        "version": "All Versions",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "TRUMPF Werkzeugmaschinen SE + Co. KG",
    "product": "Oseon",
    "versions": [
      {
        "version": "unspecified",
        "lessThanOrEqual": "1.6",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "TRUMPF Werkzeugmaschinen SE + Co. KG",
    "product": "Job Order Interface",
    "versions": [
      {
        "version": "All Versions",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "TRUMPF Werkzeugmaschinen SE + Co. KG",
    "product": "TruTops Boost with option Inventory of sheets and remainder sheets",
    "versions": [
      {
        "version": "All Versions",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "TRUMPF Werkzeugmaschinen SE + Co. KG",
    "product": "TruTops Boost with option Graphic separation of cut parts",
    "versions": [
      {
        "version": "All Versions",
        "status": "affected"
      }
    ]
  }
]

References

cert.vde.com/en/advisories/VDE-2022-023/

Social References

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.3 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

58.4%

JSON

Related for CVE-2022-2052

prion1 nvd1 cvelist1