CVE-2022-2336

Published: Aug 17, 2022Modified: Nov 21, 2024

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Softing Secure Integration Server, edgeConnector, and edgeAggregator software ships with the default administrator credentials as `admin` and password as `admin`. This allows Softing to log in to the server directly to perform administrative functions. Upon installation or upon first login, the application does not ask the user to change the `admin` password. There is no warning or prompt to ask the user to change the default password, and to change the password, many steps are required.

Affected (6)

Products: Softing: Edgeaggregator, Edgeconnector, Opc, Opc Ua C++ Software Development Kit, Secure Integration Server, Uagates

6 products

Opc Ua C++ Software Development Kit

Secure Integration Server

Uagates

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Softing Edgeaggregator	Version 3.1
Softing Edgeconnector	Version 3.1
Softing Opc	Version 5.2
Softing Opc Ua C++ Software Development Kit	Version 6
Softing Secure Integration Server	Version 1.22
Softing Uagates	Version 1.74