CVE-2022-1666

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The default password for the web application’s root user (the vendor’s private account) was weak and the MD5 hash was used to crack the password using a widely available open-source tool.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-522

Affected software

No affected versions have been published.

Timeline

Published: Jun 24, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-16677.5Client-side JavaScript controls may be bypassed by directly running a JS function to reboot the PLC (e.g., from the browser console) or by l CVE-2022-16689.8Weak default root user credentials allow remote attackers to easily obtain OS superuser privileges over the open TCP port for SSH.CVE-2022-16698.1A buffer overflow vulnerability has been detected in the firewall function of the device management web portal. The device runs a CGI binary CVE-2022-16707.5When generating a user invitation code in Octopus Server, the validity of this code can be set for a specific number of users. It was possib CVE-2022-16717.1A NULL pointer dereference flaw was found in rxrpc_preparse_s in net/rxrpc/server_key.c in the Linux kernel. This flaw allows a local attack CVE-2022-16728.8The Insights from Google PageSpeed WordPress plugin before 4.0.7 does not verify for CSRF before doing various actions such as deleting Cust CVE-2022-16736.1The WooCommerce Green Wallet Gateway WordPress plugin before 1.0.2 does not escape the error_envision query parameter before outputting it t CVE-2022-16745.5NULL Pointer Dereference in function vim_regexec_string at regexp.c:2733 in GitHub repository vim/vim prior to 8.2.4938. NULL Pointer Derefe CVE-2022-16776.3In OpenShift Container Platform, a user with permissions to create or modify Routes can craft a payload that inserts a malformed entry into CVE-2022-16787.5An issue was discovered in the Linux Kernel from 4.18 to 4.19, an improper update of sock reference in TCP pacing can lead to memory/netns l CVE-2022-16797.8A use-after-free flaw was found in the Linux kernel’s Atheros wireless adapter driver in the way a user forces the ath9k_htc_wait_for_target CVE-2022-16808.8An account takeover issue has been discovered in GitLab EE affecting all versions starting from 11.10 before 14.9.5, all versions starting f