CVE-2022-38121
Published: 10 November 2022
Summary
CVE-2022-38121 is a medium-severity Insufficiently Protected Credentials (CWE-522) vulnerability in Upspowercom Upsmon Pro. Its CVSS base score is 6.5 (Medium).
Operationally, ranked in the top 2.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
UPSMON PRO stores user passwords in plaintext within a configuration file located under a public user directory. This exposure of credentials constitutes an instance of CWE-522 and affects the application's handling of authentication data for both ordinary users and administrators.
A remote attacker who already possesses general user privileges can retrieve the unprotected file over the network and thereby obtain the account names and passwords of all users and administrators. The vulnerability carries a CVSS 3.1 score of 6.5, reflecting network attack vector, low complexity, and low required privileges with high impact on confidentiality.
Advisories addressing the issue have been published by TWCERT at the referenced URLs. The associated EPSS score reached a peak of 0.4428 and remains at that level, indicating sustained exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-40723
Vulnerability details
UPSMON PRO configuration file stores user password in plaintext under public user directory. A remote attacker with general user privilege can access all users‘ and administrators' account names and passwords via this unprotected configuration file.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Training instructs users on protecting credentials from disclosure or unauthorized access.
Training records for security awareness and role-based training verify education on credential protection practices, tangibly reducing risks from mishandling or exposing credentials.
Protecting authenticator content from unauthorized disclosure and modification while requiring protective controls addresses insufficiently protected credentials.
Rules of behavior include credential protection and non-sharing requirements, reducing exposure of insufficiently protected credentials.
Terminating or revoking credentials stops use of insufficiently protected or lingering credentials post-termination.
Requiring confidentiality/integrity protection for stored credentials directly mitigates insufficiently protected credentials on disk or in configuration stores.
Credentials or keys delivered out-of-band are not exposed to interception or inadequate protection on the main transport.