CVE-2022-2338

MEDIUM

Softing Secure Integration Server V1.22 - Auth Bypass

Title source: llm

Description

Softing Secure Integration Server V1.22 is vulnerable to authentication bypass via a machine-in-the-middle attack. The default the administration interface is accessible via plaintext HTTP protocol, facilitating the attack. The HTTP request may contain the session cookie in the request, which may be captured for use in authenticating to the server.

References (2)

Core 2

Core References

Mitigation, Third Party Advisory, US Government Resource x_refsource_confirm

https://www.cisa.gov/uscert/ics/advisories/icsa-22-228-04

Mitigation, Vendor Advisory x_refsource_confirm

https://industrial.softing.com/fileadmin/psirt/downloads/syt-2022-5.html

Scores

CVSS v3 5.7

EPSS 0.0019

EPSS Percentile 8.4%

Attack Vector ADJACENT_NETWORK

CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-319

Status published

Products (6)

softing/edgeaggregator 3.1

softing/edgeconnector 3.1

softing/opc 5.2

softing/opc_ua_c\+\+_software_development_kit 6

softing/secure_integration_server 1.22

softing/uagates 1.74

Published Aug 17, 2022

Tracked Since Feb 18, 2026