CVE-2022-26476

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability has been identified in Spectrum Power 4 (All versions using Shared HIS), Spectrum Power 7 (All versions using Shared HIS), Spectrum Power MGMS (All versions using Shared HIS). An unauthenticated attacker could log into the component Shared HIS used in Spectrum Power systems by using an account with default credentials. A successful exploitation could allow the attacker to access the component Shared HIS with administrative privileges.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-798

Affected software

No affected versions have been published.

Timeline

Published: Jun 14, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-264777.5The Security Team noticed that the termination condition of the for loop in the readExternal method is a controllable variable, which, if ta CVE-2022-264799.8An issue was discovered in Poly EagleEye Director II before 2.2.2.1. Existence of a certain file (which can be created via an rsync backdoor CVE-2022-26489.8A vulnerability was found in SourceCodester Multi Language Hotel Management Software. It has been rated as critical. This issue affects some CVE-2022-264818.8An issue was discovered in Poly Studio before 3.7.0. Command Injection can occur via the CN field of a Create Certificate Signing Request (C CVE-2022-264827.2An issue was discovered in Poly EagleEye Director II before 2.2.2.1. os.system command injection can be achieved by an admin.CVE-2022-264834.8An issue was discovered in Veritas InfoScale Operations Manager (VIOM) before 7.4.2 Patch 600 and 8.x before 8.0.0 Patch 100. A reflected cr CVE-2022-264844.9An issue was discovered in Veritas InfoScale Operations Manager (VIOM) before 7.4.2 Patch 600 and 8.x before 8.0.0 Patch 100. The web server CVE-2022-264858.8Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild ab CVE-2022-264869.6An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We have had reports of atta CVE-2022-264887.0In Python before 3.10.3 on Windows, local users can gain privileges because the search path is inadequately secured. The installer may allow CVE-2022-264907.8st21nfca_connectivity_event_received in drivers/nfc/st21nfca/se.c in the Linux kernel through 5.16.12 has EVT_TRANSACTION buffer overflows b CVE-2022-264915.9An issue was discovered in Pidgin before 2.14.9. A remote attacker who can spoof DNS responses can redirect a client connection to a malicio