Vulnerability · Published May 2, 2022 · Assigned by CERTVDE
CVE-2022-1300Missing authentication in TRUMPF products may result in corruption of data
Critical 9.8
In plain English
A critical-severity missing authentication in TruTops Boost from TRUMPF. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 75% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)1.5%top 25.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Multiple Version of TRUMPF TruTops products expose a service function without necessary authentication. Execution of this function may result in unauthorized access to change of data or disruption of the whole service.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| TRUMPF | TruTops Boost | V13.01 – before unspecifiedunspecified – through V13.05V13.08.21 |
| TRUMPF | TruTops Fab (incl. TruTops Monitor) | V22.01. – before unspecifiedunspecified – through V22.05.V22.08.21 |
Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://cert.vde.com/en/advisories/VDE-2022-016/ x_refsource_CONFIRM