CVE-2022-1401

CVE-2022-1401 concerns improper access control in Device42 CMDB prior to 18.01.00. The vulnerability exists in the /Exago/WrImageResource.adx route, enabling an unauthenticated attacker to read sensitive server files with root permissions. Affected: Device42 CMDB versions before 18.01.00. Root ca...

CVE-2022-1399

CVE-2022-1399 is a vulnerability in Device42 CMDB (versions

CVE-2022-1400

CVE-2022-1400 affects Device42 CMDB versions prior to 18.01.00 and is due to a hard-coded cryptographic key in Exago WebReportsApi.dll (WebReports API). This design flaw can allow an attacker to leak session IDs and elevate privileges within the appliance. The vulnerability is documented in NVD w...

CVE-2022-1410

CVE-2022-1410 is an OS command injection vulnerability in the db_optimize component of the Device42 Asset Management Appliance (Device42 CMDB 18.01.00 and earlier). The root cause is an OS command injection that could allow an authenticated attacker to execute remote code on the appliance, with h...