CVE-2022-2336

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Softing Secure Integration Server, edgeConnector, and edgeAggregator software ships with the default administrator credentials as `admin` and password as `admin`. This allows Softing to log in to the server directly to perform administrative functions. Upon installation or upon first login, the application does not ask the user to change the `admin` password. There is no warning or prompt to ask the user to change the default password, and to change the password, many steps are required.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
Softing	Secure Integration Server	V1.22
Softing	edgeConnector Siemens	V3.10
Softing	edgeConnector 840D	V3.10
Softing	edgeConnector Modbus	V3.10
Softing	edgeAggregator	V3.10

References

https://industrial.softing.com/fileadmin/psirt/downloads/syt-2022-6.htmlMitigation, Vendor Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-22-228-04Third Party Advisory, US Government Resource
https://industrial.softing.com/fileadmin/psirt/downloads/syt-2022-6.htmlMitigation, Vendor Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-22-228-04Third Party Advisory, US Government Resource

Timeline

Published: Aug 17, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-233639.8Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via index.php.CVE-2022-233649.8HMS v1.0 was discovered to contain a SQL injection vulnerability via adminlogin.php.CVE-2022-233659.8HMS v1.0 was discovered to contain a SQL injection vulnerability via doctorlogin.php.CVE-2022-233669.8HMS v1.0 was discovered to contain a SQL injection vulnerability via patientlogin.php.CVE-2022-233676.1Fulusso v1.1 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability in /BindAccount/SuccessTips.js. This vulnerabili CVE-2022-23377.5A crafted HTTP packet with a missing HTTP URI can create a denial-of-service condition in Softing Secure Integration Server V1.22.CVE-2022-233758.8WikiDocs version 0.1.18 has an authenticated remote code execution vulnerability. An attacker can upload a malicious file using the image up CVE-2022-233766.1WikiDocs version 0.1.18 has multiple reflected XSS vulnerabilities on different pages.CVE-2022-233777.5Archeevo below 5.0 is affected by local file inclusion through file=~/web.config to allow an attacker to retrieve local files.CVE-2022-233785.4A Cross-Site Scripting (XSS) vulnerability exists within the 3.2.2 version of TastyIgniter. The "items%5B0%5D%5Bpath%5D" parameter of a requ CVE-2022-233799.8Emlog v6.0 was discovered to contain a SQL injection vulnerability via the $TagID parameter of getblogidsfromtagid().CVE-2022-23385.3Softing Secure Integration Server V1.22 is vulnerable to authentication bypass via a machine-in-the-middle attack. The default the administr