CVE-2022-32290

The client in Northern.tech Mender 3.2.0, 3.2.1, and 3.2.2 has Incorrect Access Control. It listens on a random, unprivileged TCP port and exposes an HTTP proxy to facilitate API calls from additional client components running on the device. However, it listens on all network interfaces instead of only the localhost interface. Therefore, any client on the same network can connect to this TCP port and send HTTP requests. The Mender Client will forward these requests to the Mender Server. Additionally, if mTLS is set up, the Mender Client will connect to the Mender Server using the device's client certificate, making it possible for the attacker to bypass mTLS authentication and send requests to the Mender Server without direct access to the client certificate and related private key. Accessing the HTTP proxy from the local network doesn't represent a direct threat, because it doesn't expose any device or server-specific data. However, it increases the attack surface and can be a potential vector to exploit other vulnerabilities both on the Client and the Server.

• CWE-863

• https://mender.io/blog/cve-2022-32290-mender-client-listening-on-all-the-interfacesVendor Advisory
• https://northern.techVendor Advisory
• https://mender.io/blog/cve-2022-32290-mender-client-listening-on-all-the-interfacesVendor Advisory
• https://northern.techVendor Advisory

Published

Jul 6, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-32285A vulnerability has been identified in Mendix SAML Module (M…7.5
• CVE-2022-32286A vulnerability has been identified in Mendix SAML Module (M…6.1
• CVE-2022-32287A relative path traversal vulnerability in a FileUtil class …7.5
• CVE-2022-32288Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2022-32289Cross-Site Request Forgery (CSRF) vulnerability in Sygnoos P…4.3
• CVE-2022-3229Because the web management interface for Unified Intents' Un…9.8
• CVE-2022-32291In Real Player through 20.1.0.312, attackers can execute arb…8.8
• CVE-2022-32292In ConnMan through 1.41, remote attackers able to send HTTP …9.8
• CVE-2022-32293In ConnMan through 1.41, a man-in-the-middle attack against …8.1
• CVE-2022-32294Zimbra Collaboration Open Source 8.8.15 does not encrypt the…9.8
• CVE-2022-32295On Ampere Altra and AltraMax devices before SRP 1.09, the Al…9.8
• CVE-2022-32296The Linux kernel before 5.17.9 allows TCP servers to identif…3.3