CVE-2022-50976
Published: 02 February 2026
Summary
CVE-2022-50976 is a high-severity Improper Validation of Consistency within Input (CWE-1288) vulnerability in Innomic (inferred from references). Its CVSS base score is 7.7 (High).
Operationally, ranked at the 1.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-11 (Device Lock) and PE-3 (Physical Access Control).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
AC-11 enforces device lock and restricts access to external ports like USB without authentication, preventing a local attacker from delivering the invalid reset file.
SC-41 monitors and restricts unauthorized connections of removable media such as USB devices to external ports, blocking the exploit vector for the invalid reset file.
PE-3 controls physical access to the device, denying the local attacker the physical proximity needed to connect the USB with the invalid reset file.
NVD Description
A local attacker could cause a full device reset by resetting the device passwords using an invalid reset file via USB.
Deeper analysisAI
CVE-2022-50976 is a vulnerability that enables a local attacker to cause a full device reset by resetting the device passwords using an invalid reset file delivered via USB. Published on 2026-02-02, it has a CVSS v3.1 base score of 7.7 (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) and is associated with CWE-1288. The vulnerability affects devices from Innomic, as detailed in the vendor's security advisories.
A local attacker with physical access to the device can exploit this vulnerability with low complexity and no privileges or user interaction required. By connecting an invalid reset file via USB, the attacker can trigger a reset of the device passwords, resulting in a full device reset. This leads to high integrity and availability impacts, potentially disrupting device operations without affecting confidentiality.
Innomic has published advisories addressing this issue, available at https://www.innomic.com/.well-known/csaf/white/2026/ids-2026-0001.html and https://www.innomic.com/.well-known/csaf/white/2026/ids-2026-0001.json in HTML and JSON formats under the CSAF framework, which provide guidance on mitigations.
Details
- CWE(s)