CVE-2022-32965

ITPison OMICARD EDM - Use of Hard-coded Credentials

State: Published
Severity: 9.8 Critical
Published: Aug 4, 2022
Updated: Sep 16, 2024
Reserved: Jun 10, 2022

Description

OMICARD EDM has a hard-coded machine key. An unauthenticated remote attacker can use the machine key to send serialized payload to the server to execute arbitrary code, manipulate system data and disrupt service.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	twcert

Weaknesses

CWE-798 Use of Hard-coded Credentials

Affected Products

Product	Versions
OMICARD EDMITPison	5.8 through 6.0Affected

References

https://www.twcert.org.tw/tw/cp-132-6373-34d51-1.html
https://www.chtsecurity.com/news/48032532-b2de-401c-97a8-a2be5691988f

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.