Vulnerability · Published Oct 17, 2022 · Assigned by CERTVDE
CVE-2022-2052TRUMPF TruTops default user accounts vulnerability
Critical 9.8
In plain English
A critical-severity improper access control in Job Order Interface from TRUMPF Werkzeugmaschinen SE + Co. KG. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.8%top 44.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Multiple Trumpf Products in multiple versions use default privileged Windows users and passwords. An adversary may use these accounts to remotely gain full access to the system.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| TRUMPF Werkzeugmaschinen SE + Co. KG | TruTops Monitor | All Versions |
| TRUMPF Werkzeugmaschinen SE + Co. KG | TruTops Fab | All Versions |
| TRUMPF Werkzeugmaschinen SE + Co. KG | Oseon | unspecified – through 1.6 |
| TRUMPF Werkzeugmaschinen SE + Co. KG | Job Order Interface | All Versions |
| TRUMPF Werkzeugmaschinen SE + Co. KG | TruTops Boost with option Inventory of sheets and remainder sheets | All Versions |
| TRUMPF Werkzeugmaschinen SE + Co. KG | TruTops Boost with option Graphic separation of cut parts | All Versions |
Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H