CVE-2022-22512
Critical
Description
Hard-coded credentials in Web-UI of multiple VARTA Storage products in multiple versions allows an unauthorized attacker to gain administrative access to the Web-UI via network.
SeverityCritical
CVSS9.8
Exploit probability—
ProductVarta Element Backup Firmware
PublishedMar 23, 2023
First seenMar 23, 2023
Weakness typeCWE-798Hard-coded credentials
How to fix
Update
- varta element_backup_firmwaref21000400 or later
- varta element_s1_firmware2e.3.8.0 or later
- varta element_s2_firmware2e.3.8.0 or later
- varta element_s3_firmware2e.3.8.0, 2e.4.4.0 or later
- varta element_s4_firmwared21010400 or later
- varta one_l_firmware2e.3.8.0 or later
- varta one_xl_firmware2e.3.8.0 or later
- varta pulse_firmwarec21010800 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| varta element_backup_firmware | v < f21000400 | f21000400 |
| varta element_s1_firmware | v < 2e.3.8.0 | 2e.3.8.0 |
| varta element_s2_firmware | v < 2e.3.8.0 | 2e.3.8.0 |
| varta element_s3_firmware | v < 2e.3.8.0, 2e.4.0.0 ≤ v < 2e.4.4.0 | 2e.3.8.0, 2e.4.4.0 |
| varta element_s4_firmware | v < d21010400 | d21010400 |
| varta one_l_firmware | v < 2e.3.8.0 | 2e.3.8.0 |
| varta one_xl_firmware | v < 2e.3.8.0 | 2e.3.8.0 |
| varta pulse_firmware | v < c21010800 | c21010800 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.