CVEvulnerability

CVE-2022-2336

9.8 CRITICAL Published 2022-08-17 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-08-17
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-287

Description

Softing Secure Integration Server, edgeConnector, and edgeAggregator software ships with the default administrator credentials as `admin` and password as `admin`. This allows Softing to log in to the server directly to perform administrative functions. Upon installation or upon first login, the application does not ask the user to change the `admin` password. There is no warning or prompt to ask the user to change the default password, and to change the password, many steps are required.

Affected configurations

• softing edgeaggregator 3.1 • softing edgeconnector 3.1 • softing opc 5.2 • softing opc ua c\+\+ software development kit 6 • softing secure integration server 1.22 • softing uagates 1.74

Related

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

Referenced by CWE · observed example (1)

  • CWE-1393 Use of Default Password weakness

References