What is CVE-2022-1368?

CVE-2022-1368 is a critical-severity vulnerability in Cognex 3d-A1000 Dimensioning System, classified under Missing Authentication for Critical Function. CVSS score: 9.8/10. Published 2022-09-06.

How severe is CVE-2022-1368?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Auth bypass in Cognex 3d-A1000 Dimensioning System

CVE-2022-1368

The Cognex 3D-A1000 Dimensioning System in firmware version 1.0.3 (3354) and prior is vulnerable to CWE-306: Missing Authentication for Critical Function, which allows unauthorized users to change the operator account password via webserver commands by monitoring web socket communications from an unauthenticated session. This could allow an attacker to escalate privileges to match those of the compromised account.

Vulnerability class: Broken Authentication

EPSS: 0.008 (53.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Weakness classification (CWE)

CWE-306 — Missing Authentication for Critical Function

References

ics-cert@hq.dhs.gov (US Government Resource, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2022-1368?: CVE-2022-1368 is a critical-severity vulnerability in Cognex 3d-A1000 Dimensioning System, classified under Missing Authentication for Critical Function. CVSS score: 9.8/10. Published 2022-09-06.
How severe is CVE-2022-1368?: Critical severity. CVSS v3 base score is 9.8 out of 10.