Vulnerability Description
Softing Secure Integration Server, edgeConnector, and edgeAggregator software ships with the default administrator credentials as `admin` and password as `admin`. This allows Softing to log in to the server directly to perform administrative functions. Upon installation or upon first login, the application does not ask the user to change the `admin` password. There is no warning or prompt to ask the user to change the default password, and to change the password, many steps are required.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Softing | Edgeaggregator | 3.1 |
| Softing | Edgeconnector | 3.1 |
| Softing | Opc | 5.2 |
| Softing | Opc Ua C\+\+ Software Development Kit | 6 |
| Softing | Secure Integration Server | 1.22 |
| Softing | Uagates | 1.74 |
Related Weaknesses (CWE)
References
- https://industrial.softing.com/fileadmin/psirt/downloads/syt-2022-6.htmlMitigationVendor Advisory
- https://www.cisa.gov/uscert/ics/advisories/icsa-22-228-04Third Party AdvisoryUS Government Resource
- https://industrial.softing.com/fileadmin/psirt/downloads/syt-2022-6.htmlMitigationVendor Advisory
- https://www.cisa.gov/uscert/ics/advisories/icsa-22-228-04Third Party AdvisoryUS Government Resource
FAQ
What is CVE-2022-2336?
CVE-2022-2336 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Softing Secure Integration Server, edgeConnector, and edgeAggregator software ships with the default administrator credentials as `admin` and password as `admin`. This allows Softing to log in to the ...
How severe is CVE-2022-2336?
CVE-2022-2336 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2022-2336?
Check the references section above for vendor advisories and patch information. Affected products include: Softing Edgeaggregator, Softing Edgeconnector, Softing Opc, Softing Opc Ua C\+\+ Software Development Kit, Softing Secure Integration Server.