CVE-2022-38069
Last modified
CVE-2022-38069 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. Multiple globally default credentials exist across all CMS8000 devices, that once exposed, allow a threat actor with momentary physical access to gain privileged access to any device. Privileged credential access enables the extraction of sensitive patient information or modification of device parameters. EPSS estimates a 0.29% chance of exploitation in the next 30 days.
Description
Multiple globally default credentials exist across all CMS8000 devices, that once exposed, allow a threat actor with momentary physical access to gain privileged access to any device. Privileged credential access enables the extraction of sensitive patient information or modification of device parameters
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Contechealth | Cms8000 Firmware | All versions |
References
- https://www.cisa.gov/uscert/ics/advisories/icsma-22-244-01Mitigation, Third Party Advisory, US Government Resource
- https://www.cisa.gov/uscert/ics/advisories/icsma-22-244-01Mitigation, Third Party Advisory, US Government Resource
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-38069?
How severe is CVE-2022-38069?
How do I fix CVE-2022-38069?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-38063Cross-Site Request Forgery (CSRF) vulnerability in Social Lo…8.8
- CVE-2022-38064OpenHarmony-v3.1.2 and prior versions have a permission bypa…5.5
- CVE-2022-38065A privilege escalation vulnerability exists in the oslo.priv…8.8
- CVE-2022-38066An OS command injection vulnerability exists in the httpd SN…8.8
- CVE-2022-38067Unauthenticated Event Deletion vulnerability in Totalsoft Ev…5.3
- CVE-2022-38068Authenticated (admin+) Stored Cross-Site Scripting (XSS) vul…4.8
- CVE-2022-3807A vulnerability was found in Axiomatic Bento4. It has been r…6.5
- CVE-2022-38070Privilege Escalation (subscriber+) vulnerability in Pop-up p…8.8
- CVE-2022-38071Rejected reason: This CVE ID has been rejected or withdrawn …
- CVE-2022-38072An improper array index validation vulnerability exists in t…8.8
- CVE-2022-38073Multiple Authenticated (custom specific plugin role) Persist…5.4
- CVE-2022-38074SQL Injection vulnerability in VeronaLabs WP Statistics plug…8.8
Are you affected by CVE-2022-38069?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST