CVE-2022-1401
Published: 17 August 2022
Summary
CVE-2022-1401 is a medium-severity Incorrect Authorization (CWE-863) vulnerability in Device42 Cmdb. Its CVSS base score is 6.9 (Medium).
Operationally, ranked in the top 10.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2022-1401 is an improper access control vulnerability (CWE-863) in the /Exago/WrImageResource.adx route of the Device42 Asset Management Appliance. It affects Device42 CMDB versions prior to 18.01.00 and permits an unauthenticated attacker to read arbitrary sensitive server files while operating with root permissions. The flaw carries a CVSS 3.1 score of 6.9 with an attack vector of adjacent network, high attack complexity, and no required privileges or user interaction.
An attacker positioned on an adjacent network can exploit the route without authentication to retrieve files that would otherwise be inaccessible, achieving high-impact confidentiality exposure combined with limited integrity effects under the reported scope change.
The two provided references point to the same Bitdefender red-team analysis of the Device42 appliance; neither advisory text nor patch details are supplied in the CVE record itself. The associated EPSS score remains flat at 0.0504 with no material increase after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-24717
Vulnerability details
Improper Access Control vulnerability in the /Exago/WrImageResource.adx route as used in Device42 Asset Management Appliance allows an unauthenticated attacker to read sensitive server files with root permissions. This issue affects: Device42 CMDB versions prior to 18.01.00.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Periodic review and update of procedures reduces incorrect authorization implementations over time.
Supervision identifies cases where authorization logic incorrectly permits unauthorized actions.
Defining permitted attribute values and auditing modifications reduces the chance of incorrect authorization outcomes due to tampered or missing labels.
The authorization process and usage restrictions help prevent incorrect authorization for remote access types.
Establishing configuration and connection requirements helps ensure correct rather than incorrect authorization for wireless access.
Establishing connection authorization processes for mobile devices helps ensure authorization decisions are correctly implemented rather than incorrect.
Monitoring account use, notifying on changes, and reviewing accounts for compliance corrects incorrect authorization assignments.
Ensures authorization decisions for external system use are correctly implemented and enforced.