Vulnerability · Published Mar 23, 2023 · Assigned by CERTVDE
CVE-2022-22512VARTA: Multiple devices prone to hard-coded credentials
Critical 9.8
In plain English
A critical-severity hard-coded credentials in Element backup from VARTA Storage. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.7%top 47.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Hard-coded credentials in Web-UI of multiple VARTA Storage products in multiple versions allows an unauthorized attacker to gain administrative access to the Web-UI via network.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| VARTA Storage | Element backup | 0 – before F21000400 |
| VARTA Storage | Element S1 | 0 – before 2e.3.8.0 |
| VARTA Storage | Element S2 | 0 – before 2e.3.8.0 |
| VARTA Storage | Element S2 | 0 – before 2e.3.8.0 |
| VARTA Storage | Element S3 | 0 – before 2e.3.8.0 |
| VARTA Storage | Element S3 | 0 – before 2e.4.4.0 |
| VARTA Storage | Element S4 | 0 – before D21010400 |
| VARTA Storage | One L/XL | 0 – before 2e.3.8.0 |
| VARTA Storage | Pulse (not pulse neo) | 0 – before C21010800 |
Weakness: CWE-798 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H