PT-2022-22393 · Ifm · Ifm Moneo Appliance

Aimon Dawson · Published 2022-12-12 · Updated 2023-03-01 · CVE-2022-3485

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IFM Moneo Appliance versions up to 1.9.3

Description An unauthenticated remote attacker can reset the administrator password by only supplying the serial number, thus gaining full control of the device.

Recommendations For versions up to 1.9.3, as a temporary workaround, consider restricting access to the device to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-640

Related Identifiers

CVE-2022-3485

Affected Products

Ifm Moneo Appliance

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2022-3485 · Security Note
• https://osv.dev/vulnerability/CVE-2022-3485 · Vendor Advisory
• https://t.me/cvenotify/39629 · Telegram Post
• https://cert.vde.com/en/advisories/VDE-2022-050 · Note
• https://t.me/cibsecurity/54277 · Telegram Post
• https://t.me/cvenotify/39901 · Telegram Post