Vulnerability · Published Aug 4, 2022 · Assigned by twcert
CVE-2022-32965ITPison OMICARD EDM - Use of Hard-coded Credentials
Critical 9.8
In plain English
A critical-severity hard-coded credentials in OMICARD EDM from ITPison. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)1.5%top 25.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
OMICARD EDM has a hard-coded machine key. An unauthenticated remote attacker can use the machine key to send serialized payload to the server to execute arbitrary code, manipulate system data and disrupt service.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ITPison | OMICARD EDM | 5.8 – through 6.0 |
Weakness: CWE-798 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://www.twcert.org.tw/tw/cp-132-6373-34d51-1.html x_refsource_MISC
- https://www.chtsecurity.com/news/48032532-b2de-401c-97a8-a2be5691988f x_refsource_MISC