Cyber Resilience

CVE-2022-50976

High

Published: 02 February 2026

Published
02 February 2026
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.7 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
EPSS Score 0.0001 1.4th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-50976 is a high-severity Improper Validation of Consistency within Input (CWE-1288) vulnerability in Innomic (inferred from references). Its CVSS base score is 7.7 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Replication Through Removable Media (T1091); ranked at the 1.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-11 (Device Lock) and PE-3 (Physical Access Control).

Deeper analysis

CVE-2022-50976 is a vulnerability that enables a local attacker to cause a full device reset by resetting the device passwords using an invalid reset file delivered via USB. Published on 2026-02-02, it has a CVSS v3.1 base score of 7.7 (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) and is associated with CWE-1288. The vulnerability affects devices from Innomic, as detailed in the vendor's security advisories.

A local attacker with physical access to the device can exploit this vulnerability with low complexity and no privileges or user interaction required. By connecting an invalid reset file via USB, the attacker can trigger a reset of the device passwords, resulting in a full device reset. This leads to high integrity and availability impacts, potentially disrupting device operations without affecting confidentiality.

Innomic has published advisories addressing this issue, available at https://www.innomic.com/.well-known/csaf/white/2026/ids-2026-0001.html and https://www.innomic.com/.well-known/csaf/white/2026/ids-2026-0001.json in HTML and JSON formats under the CSAF framework, which provide guidance on mitigations.

EU & UK References

Vulnerability details

A local attacker could cause a full device reset by resetting the device passwords using an invalid reset file via USB.

CWE(s)
CWE-1288

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1091 Replication Through Removable Media Lateral Movement
Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes.
attack.mitre.org →
T1490 Inhibit System Recovery Impact
Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
attack.mitre.org →
Why these techniques?

USB-delivered invalid reset file enables physical media-based attack leading to device reset and inhibited recovery.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

Affected Assets

Innomic
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

AC-11 Device Lock good match
prevent

AC-11 enforces device lock and restricts access to external ports like USB without authentication, preventing a local attacker from delivering the invalid reset file.

SC-41 Port and I/O Device Access good match
preventdetect

SC-41 monitors and restricts unauthorized connections of removable media such as USB devices to external ports, blocking the exploit vector for the invalid reset file.

PE-3 Physical Access Control good match
prevent

PE-3 controls physical access to the device, denying the local attacker the physical proximity needed to connect the USB with the invalid reset file.

References