PT-2022-15952 · Softing · Edgeaggregator+2

Pedro Ribeiro + 1 · Published 2022-08-17 · Updated 2025-07-15 · CVE-2022-2336

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Softing Secure Integration Server, edgeConnector, and edgeAggregator software (affected versions not specified)

Description The issue concerns the use of default administrator credentials, with the username as admin and the password as admin. This allows for direct login to the server to perform administrative functions without prompting the user to change the default password upon installation or first login. The process to change the password is complex and requires multiple steps.

Recommendations For Softing Secure Integration Server, edgeConnector, and edgeAggregator software, change the default administrator password admin to a strong, unique password as soon as possible to prevent unauthorized access. As a temporary workaround, consider restricting access to the server until the default password is changed. Avoid using the default admin credentials for any administrative functions until the password is updated.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2022-2336

ZDI-22-1161

Affected Products

Softing Secure Integration Server

Edgeaggregator

Edgeconnector

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2022-2336 · Security Note
• https://industrial.softing.com/fileadmin/psirt/downloads/syt-2022-6.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-2336 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-22-1161 · Security Note
• https://twitter.com/cheese_monkey00/status/1945153288904556706 · Twitter Post
• https://cisa.gov/uscert/ics/advisories/icsa-22-228-04 · Note