What is CVE-2022-36642?

CVE-2022-36642 is a critical-severity vulnerability in Telosalliance Omnia Mpx Node, classified under Missing Authorization. CVSS score: 9.8/10. Published 2022-09-02.

How severe is CVE-2022-36642?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Is CVE-2022-36642 known to be exploited?

10 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Auth bypass in Telosalliance Omnia Mpx Node

CVE-2022-36642

A local file disclosure vulnerability in /appConfig/userDB.json of Telos Alliance Omnia MPX Node through 1.0.0-1.4.9 allows attackers to access users credentials which makes him able to gain initial access to the control panel with high privilege because the cleartext storage of sensitive information which can be unlatched by exploiting the LFD vulnerability.

Vulnerability class: Broken Access Control

Published 2022-09-02 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.129 (96.2th percentile), scored 2026-10-01.

Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 96th percentile — 96.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.126 · newest: 0.129 · change: +0.003

Affected products

Telosalliance Omnia Mpx Node
Telosalliance Omnia Mpx Node Firmware — versions 1.5.0

Weakness classification (CWE)

CWE-862 — Missing Authorization

Public proof-of-concept exploits

References

drive.google.com/drive/folders/1jm9h8JNmezTt7AbHYRY7gPC4lXGDNklL (Exploit, Third Party Advisory)
www.telosalliance.com/radio-processing/audio-interfaces/omnia-mpx-node (Product, Vendor Advisory)
cyber-guy.gitbook.io/cyber-guy/pocs/omnia-node-mpx-auth-bypass-via-lfd (Exploit, Third Party Advisory)
www.exploit-db.com/exploits/50996 (Exploit, VDB Entry, Third Party Advisory)
cyber-guy.gitbook.io/cyber-guys-blog/blogs/bypassing-mpx-node-authentication-fi… (Exploit, Third Party Advisory)

Frequently asked questions

What is CVE-2022-36642?: CVE-2022-36642 is a critical-severity vulnerability in Telosalliance Omnia Mpx Node, classified under Missing Authorization. CVSS score: 9.8/10. Published 2022-09-02.
How severe is CVE-2022-36642?: Critical severity. CVSS v3 base score is 9.8 out of 10.
Is CVE-2022-36642 known to be exploited?: 10 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.