CVE-2022-2052 - Vulnerability Details - OpenCVE

Multiple Trumpf Products in multiple versions use default privileged Windows users and passwords. An adversary may use these accounts to remotely gain full access to the system.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Trumpf	Job Order Interface Oseon Trutops Boost Trutops Fab Trutops Monitor

Configuration 1 [-]

OR	cpe:2.3:a:trumpf:job_order_interface::::::::
	cpe:2.3:a:trumpf:oseon::::::::
	cpe:2.3:a:trumpf:trutops_boost::::::::
	cpe:2.3:a:trumpf:trutops_fab::::::::
	cpe:2.3:a:trumpf:trutops_monitor::::::::

No data.

References

Link	Providers
https://cert.vde.com/en/advisories/VDE-2022-023/

History

Sat, 10 May 2025 03:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: CERTVDE

Published: 2022-10-17T08:20:11.346Z

Updated: 2025-05-10T02:57:40.699Z

Reserved: 2022-06-10T00:00:00.000Z

Link: CVE-2022-2052

Vulnrichment

Updated: 2024-08-03T00:24:44.261Z

NVD

Status : Modified

Published: 2022-10-17T09:15:12.150

Modified: 2024-11-21T07:00:14.330

Link: CVE-2022-2052

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-2052", "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "assignerShortName": "CERTVDE", "datePublished": "2022-10-17T08:20:11.346Z", "dateUpdated": "2025-05-10T02:57:40.699Z", "dateReserved": "2022-06-10T00:00:00.000Z"}, "containers": {"cna": {"title": "TRUMPF TruTops default user accounts vulnerability", "datePublic": "2022-10-17T00:00:00.000Z", "providerMetadata": {"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "shortName": "CERTVDE", "dateUpdated": "2022-10-17T00:00:00.000Z"}, "descriptions": [{"lang": "en", "value": "Multiple Trumpf Products in multiple versions use default privileged Windows users and passwords. An adversary may use these accounts to remotely gain full access to the system."}], "affected": [{"vendor": "TRUMPF Werkzeugmaschinen SE + Co. KG", "product": "TruTops Monitor", "versions": [{"version": "All Versions", "status": "affected"}]}, {"vendor": "TRUMPF Werkzeugmaschinen SE + Co. KG", "product": "TruTops Fab", "versions": [{"version": "All Versions", "status": "affected"}]}, {"vendor": "TRUMPF Werkzeugmaschinen SE + Co. KG", "product": "Oseon", "versions": [{"version": "unspecified", "lessThanOrEqual": "1.6", "status": "affected", "versionType": "custom"}]}, {"vendor": "TRUMPF Werkzeugmaschinen SE + Co. KG", "product": "Job Order Interface", "versions": [{"version": "All Versions", "status": "affected"}]}, {"vendor": "TRUMPF Werkzeugmaschinen SE + Co. KG", "product": "TruTops Boost with option Inventory of sheets and remainder sheets", "versions": [{"version": "All Versions", "status": "affected"}]}, {"vendor": "TRUMPF Werkzeugmaschinen SE + Co. KG", "product": "TruTops Boost with option Graphic separation of cut parts", "versions": [{"version": "All Versions", "status": "affected"}]}], "references": [{"url": "https://cert.vde.com/en/advisories/VDE-2022-023/"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-284 Improper Access Control", "cweId": "CWE-284"}]}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "source": {"advisory": "VDE-2022-023", "defect": ["CERT@VDE#64131"], "discovery": "INTERNAL"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T00:24:44.261Z"}, "title": "CVE Program Container", "references": [{"url": "https://cert.vde.com/en/advisories/VDE-2022-023/", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-05-10T02:57:27.303845Z", "id": "CVE-2022-2052", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-10T02:57:40.699Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://cert.vde.com/en/advisories/VDE-2022-023/", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T00:24:44.261Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-2052", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-05-10T02:57:27.303845Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-10T02:57:35.935Z"}}], "cna": {"title": "TRUMPF TruTops default user accounts vulnerability", "source": {"defect": ["CERT@VDE#64131"], "advisory": "VDE-2022-023", "discovery": "INTERNAL"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "TRUMPF Werkzeugmaschinen SE + Co. KG", "product": "TruTops Monitor", "versions": [{"status": "affected", "version": "All Versions"}]}, {"vendor": "TRUMPF Werkzeugmaschinen SE + Co. KG", "product": "TruTops Fab", "versions": [{"status": "affected", "version": "All Versions"}]}, {"vendor": "TRUMPF Werkzeugmaschinen SE + Co. KG", "product": "Oseon", "versions": [{"status": "affected", "version": "unspecified", "versionType": "custom", "lessThanOrEqual": "1.6"}]}, {"vendor": "TRUMPF Werkzeugmaschinen SE + Co. KG", "product": "Job Order Interface", "versions": [{"status": "affected", "version": "All Versions"}]}, {"vendor": "TRUMPF Werkzeugmaschinen SE + Co. KG", "product": "TruTops Boost with option Inventory of sheets and remainder sheets", "versions": [{"status": "affected", "version": "All Versions"}]}, {"vendor": "TRUMPF Werkzeugmaschinen SE + Co. KG", "product": "TruTops Boost with option Graphic separation of cut parts", "versions": [{"status": "affected", "version": "All Versions"}]}], "datePublic": "2022-10-17T00:00:00.000Z", "references": [{"url": "https://cert.vde.com/en/advisories/VDE-2022-023/"}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "descriptions": [{"lang": "en", "value": "Multiple Trumpf Products in multiple versions use default privileged Windows users and passwords. An adversary may use these accounts to remotely gain full access to the system."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284 Improper Access Control"}]}], "providerMetadata": {"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "shortName": "CERTVDE", "dateUpdated": "2022-10-17T00:00:00.000Z"}}}, "cveMetadata": {"cveId": "CVE-2022-2052", "state": "PUBLISHED", "dateUpdated": "2025-05-10T02:57:40.699Z", "dateReserved": "2022-06-10T00:00:00.000Z", "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "datePublished": "2022-10-17T08:20:11.346Z", "assignerShortName": "CERTVDE"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:trumpf:job_order_interface:*:*:*:*:*:*:*:*", "matchCriteriaId": "23618C14-F7A5-46D5-9861-1439F197622A", "vulnerable": true}, {"criteria": "cpe:2.3:a:trumpf:oseon:*:*:*:*:*:*:*:*", "matchCriteriaId": "806F1D17-51DF-431D-B34B-7EC4FA7D5873", "versionEndIncluding": "1.6", "vulnerable": true}, {"criteria": "cpe:2.3:a:trumpf:trutops_boost:*:*:*:*:*:*:*:*", "matchCriteriaId": "7FE4279B-0D8E-4B0E-8D38-A3AF0C90A0C5", "vulnerable": true}, {"criteria": "cpe:2.3:a:trumpf:trutops_fab:*:*:*:*:*:*:*:*", "matchCriteriaId": "52F57117-C6A3-426E-9AE9-E47596BB0E40", "vulnerable": true}, {"criteria": "cpe:2.3:a:trumpf:trutops_monitor:*:*:*:*:*:*:*:*", "matchCriteriaId": "5114C779-4A9D-4F09-AFBD-42DB013E063A", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Multiple Trumpf Products in multiple versions use default privileged Windows users and passwords. An adversary may use these accounts to remotely gain full access to the system."}, {"lang": "es", "value": "Varios productos de Trumpf en m\u00faltiples versiones usan usuarios y contrase\u00f1as privilegiados de Windows por defecto. Un adversario puede usar estas cuentas para conseguir acceso completo al sistema de forma remota"}], "id": "CVE-2022-2052", "lastModified": "2024-11-21T07:00:14.330", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "info@cert.vde.com", "type": "Secondary"}]}, "published": "2022-10-17T09:15:12.150", "references": [{"source": "info@cert.vde.com", "tags": ["Third Party Advisory"], "url": "https://cert.vde.com/en/advisories/VDE-2022-023/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://cert.vde.com/en/advisories/VDE-2022-023/"}], "sourceIdentifier": "info@cert.vde.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "info@cert.vde.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}