Vulnerability · Published Dec 12, 2022 · Assigned by CERTVDE
CVE-2022-3485Weak Password Recovery in ifm moneo appliance
Critical 9.8
In plain English
A critical-severity security flaw in moneo appliance from ifm. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)1.0%top 37.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
In IFM Moneo Appliance with version up to 1.9.3 an unauthenticated remote attacker can reset the administrator password by only supplying the serial number and thus gain full control of the device.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ifm | moneo appliance | 0 – through 1.9.3 |
| ifm | moneo appliance | 0 – through 1.9.3 |
Weakness: CWE-640 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H