CVE-2022-2302
Critical
Description
Multiple Lenze products of the cabinet series skip the password verification upon second login. After a user has been logged on to the device once, a remote attacker can get full access without knowledge of the password.
SeverityCritical
CVSS9.8
Exploit probability—
ProductLenze C520 Firmware
PublishedJul 11, 2022
First seenJul 11, 2022
Weakness typeCWE-304CWE-304
How to fix
Update
- lenze c520_firmware01.08.01.3021 or later
- lenze c550_firmware01.08.01.3021 or later
- lenze c750_firmware01.08.01.3021 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| lenze c520_firmware | 1.07.00.2757 ≤ v < 01.08.01.3021 | 01.08.01.3021 |
| lenze c550_firmware | 1.07.00.2757 ≤ v < 01.08.01.3021 | 01.08.01.3021 |
| lenze c750_firmware | 1.07.00.2757 ≤ v < 01.08.01.3021 | 01.08.01.3021 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.