CVE-2022-22512

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Hard-coded credentials in Web-UI of multiple VARTA Storage products in multiple versions allows an unauthorized attacker to gain administrative access to the Web-UI via network.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-798

Affected software

No affected versions have been published.

Timeline

Published
Mar 23, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-225136.5An authenticated remote attacker can cause a null pointer dereference in the CmpSettings component of the affected CODESYS products which leCVE-2022-225147.1An authenticated, remote attacker can gain access to a dereferenced pointer contained in a request. The accesses can subsequently lead to loCVE-2022-225158.1A remote, authenticated attacker could utilize the control program of the CODESYS Control runtime system to use the vulnerability in order tCVE-2022-225167.8The SysDrv3S driver in the CODESYS Control runtime system on Microsoft Windows allows any system user to read and write within restricted meCVE-2022-225177.5An unauthenticated, remote attacker can disrupt existing communication channels between CODESYS products by guessing a valid channel ID and CVE-2022-225186.5A bug in CmpUserMgr component can lead to only partially applied security policies. This can result in enabled, anonymous access to componenCVE-2022-225197.5A remote, unauthenticated attacker can send a specific crafted HTTP or HTTPS requests causing a buffer over-read resulting in a crash of theCVE-2022-22526.1Open Redirect in GitHub repository microweber/microweber prior to 1.2.19.CVE-2022-225205.3A remote, unauthenticated attacker can enumerate valid users by sending specific requests to the webservice of MB connect line mymbCONNECT24CVE-2022-225217.3In Miele Benchmark Programming Tool with versions Prior to 1.2.71, executable files manipulated by attackers are unknowingly executed with uCVE-2022-225229.8In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could make use of hCVE-2022-225237.5An improper authentication vulnerability exists in the Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 We
CVE-2022-22512: Critical severity, CVSS 9.8 | Vulnix