PT-2022-28087 · Isos · Isos

Published 2022-12-28 · Updated 2023-01-10 · CVE-2022-4780

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ISOS firmwares versions 1.81 through 2.00

Description The issue concerns hardcoded credentials in the embedded StreamX installer within ISOS firmwares. These credentials are not mandatory for integrators to change, posing a security risk.

Recommendations For ISOS firmwares versions 1.81 through 2.00, consider changing the hardcoded credentials from the embedded StreamX installer to unique, secure credentials to mitigate the risk of unauthorized access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2022-4780

Affected Products

Isos

References · 4

• https://elvexys.com/products/xpg-gateway-rtu-protocol-converter/isos-release-notes · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-4780 · Security Note
• https://osv.dev/vulnerability/CVE-2022-4780 · Vendor Advisory
• https://t.me/cvenotify/41722 · Telegram Post