CVE-2022-2052 - Vulnerability Details - OpenCVE

Description

Multiple Trumpf Products in multiple versions use default privileged Windows users and passwords. An adversary may use these accounts to remotely gain full access to the system.

Published: 2022-10-17

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

TRUMPF Werkzeugmaschinen SE + Co. KG

TruTops Monitor

affected

Version	Status	Constraints
`All Versions`	affected	—

TRUMPF Werkzeugmaschinen SE + Co. KG

TruTops Fab

affected

Version	Status	Constraints
`All Versions`	affected	—

TRUMPF Werkzeugmaschinen SE + Co. KG

Oseon

affected

Version	Status	Constraints
`unspecified`	affected	≤ 1.6

TRUMPF Werkzeugmaschinen SE + Co. KG

Job Order Interface

affected

Version	Status	Constraints
`All Versions`	affected	—

TRUMPF Werkzeugmaschinen SE + Co. KG

TruTops Boost with option Inventory of sheets and remainder sheets

affected

Version	Status	Constraints
`All Versions`	affected	—

TRUMPF Werkzeugmaschinen SE + Co. KG

TruTops Boost with option Graphic separation of cut parts

affected

Version	Status	Constraints
`All Versions`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:trumpf:job_order_interface::::::::
	cpe:2.3:a:trumpf:oseon::::::::
	cpe:2.3:a:trumpf:trutops_boost::::::::
	cpe:2.3:a:trumpf:trutops_fab::::::::
	cpe:2.3:a:trumpf:trutops_monitor::::::::

No data.

No data available yet.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
EUVD	EUVD-2022-34353	Multiple Trumpf Products in multiple versions use default privileged Windows users and passwords. An adversary may use these accounts to remotely gain full access to the system.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00363.

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://cert.vde.com/en/advisories/VDE-2022-023/

History

Sat, 12 Jul 2025 13:45:00 +0000

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00082}`	epss `{'score': 0.00103}`

Sat, 10 May 2025 03:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Subscriptions

Trumpf Job Order Interface Oseon Trutops Boost Trutops Fab Trutops Monitor

MITRE

Status: PUBLISHED

Assigner: CERTVDE

Published: 2022-10-17T08:20:11.346Z

Updated: 2025-05-10T02:57:40.699Z

Reserved: 2022-06-10T00:00:00.000Z

Link: CVE-2022-2052

Vulnrichment

Updated: 2024-08-03T00:24:44.261Z

NVD

Status : Modified

Published: 2022-10-17T09:15:12.150

Modified: 2024-11-21T07:00:14.330

Link: CVE-2022-2052

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-2052", "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "assignerShortName": "CERTVDE", "datePublished": "2022-10-17T08:20:11.346Z", "dateUpdated": "2025-05-10T02:57:40.699Z", "dateReserved": "2022-06-10T00:00:00.000Z"}, "containers": {"cna": {"title": "TRUMPF TruTops default user accounts vulnerability", "datePublic": "2022-10-17T00:00:00.000Z", "providerMetadata": {"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "shortName": "CERTVDE", "dateUpdated": "2022-10-17T00:00:00.000Z"}, "descriptions": [{"lang": "en", "value": "Multiple Trumpf Products in multiple versions use default privileged Windows users and passwords. An adversary may use these accounts to remotely gain full access to the system."}], "affected": [{"vendor": "TRUMPF Werkzeugmaschinen SE + Co. KG", "product": "TruTops Monitor", "versions": [{"version": "All Versions", "status": "affected"}]}, {"vendor": "TRUMPF Werkzeugmaschinen SE + Co. KG", "product": "TruTops Fab", "versions": [{"version": "All Versions", "status": "affected"}]}, {"vendor": "TRUMPF Werkzeugmaschinen SE + Co. KG", "product": "Oseon", "versions": [{"version": "unspecified", "lessThanOrEqual": "1.6", "status": "affected", "versionType": "custom"}]}, {"vendor": "TRUMPF Werkzeugmaschinen SE + Co. KG", "product": "Job Order Interface", "versions": [{"version": "All Versions", "status": "affected"}]}, {"vendor": "TRUMPF Werkzeugmaschinen SE + Co. KG", "product": "TruTops Boost with option Inventory of sheets and remainder sheets", "versions": [{"version": "All Versions", "status": "affected"}]}, {"vendor": "TRUMPF Werkzeugmaschinen SE + Co. KG", "product": "TruTops Boost with option Graphic separation of cut parts", "versions": [{"version": "All Versions", "status": "affected"}]}], "references": [{"url": "https://cert.vde.com/en/advisories/VDE-2022-023/"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-284 Improper Access Control", "cweId": "CWE-284"}]}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "source": {"advisory": "VDE-2022-023", "defect": ["CERT@VDE#64131"], "discovery": "INTERNAL"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T00:24:44.261Z"}, "title": "CVE Program Container", "references": [{"url": "https://cert.vde.com/en/advisories/VDE-2022-023/", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-05-10T02:57:27.303845Z", "id": "CVE-2022-2052", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-10T02:57:40.699Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://cert.vde.com/en/advisories/VDE-2022-023/", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T00:24:44.261Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-2052", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-05-10T02:57:27.303845Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-10T02:57:35.935Z"}}], "cna": {"title": "TRUMPF TruTops default user accounts vulnerability", "source": {"defect": ["CERT@VDE#64131"], "advisory": "VDE-2022-023", "discovery": "INTERNAL"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "TRUMPF Werkzeugmaschinen SE + Co. KG", "product": "TruTops Monitor", "versions": [{"status": "affected", "version": "All Versions"}]}, {"vendor": "TRUMPF Werkzeugmaschinen SE + Co. KG", "product": "TruTops Fab", "versions": [{"status": "affected", "version": "All Versions"}]}, {"vendor": "TRUMPF Werkzeugmaschinen SE + Co. KG", "product": "Oseon", "versions": [{"status": "affected", "version": "unspecified", "versionType": "custom", "lessThanOrEqual": "1.6"}]}, {"vendor": "TRUMPF Werkzeugmaschinen SE + Co. KG", "product": "Job Order Interface", "versions": [{"status": "affected", "version": "All Versions"}]}, {"vendor": "TRUMPF Werkzeugmaschinen SE + Co. KG", "product": "TruTops Boost with option Inventory of sheets and remainder sheets", "versions": [{"status": "affected", "version": "All Versions"}]}, {"vendor": "TRUMPF Werkzeugmaschinen SE + Co. KG", "product": "TruTops Boost with option Graphic separation of cut parts", "versions": [{"status": "affected", "version": "All Versions"}]}], "datePublic": "2022-10-17T00:00:00.000Z", "references": [{"url": "https://cert.vde.com/en/advisories/VDE-2022-023/"}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "descriptions": [{"lang": "en", "value": "Multiple Trumpf Products in multiple versions use default privileged Windows users and passwords. An adversary may use these accounts to remotely gain full access to the system."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284 Improper Access Control"}]}], "providerMetadata": {"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "shortName": "CERTVDE", "dateUpdated": "2022-10-17T00:00:00.000Z"}}}, "cveMetadata": {"cveId": "CVE-2022-2052", "state": "PUBLISHED", "dateUpdated": "2025-05-10T02:57:40.699Z", "dateReserved": "2022-06-10T00:00:00.000Z", "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "datePublished": "2022-10-17T08:20:11.346Z", "assignerShortName": "CERTVDE"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:trumpf:job_order_interface:*:*:*:*:*:*:*:*", "matchCriteriaId": "23618C14-F7A5-46D5-9861-1439F197622A", "vulnerable": true}, {"criteria": "cpe:2.3:a:trumpf:oseon:*:*:*:*:*:*:*:*", "matchCriteriaId": "806F1D17-51DF-431D-B34B-7EC4FA7D5873", "versionEndIncluding": "1.6", "vulnerable": true}, {"criteria": "cpe:2.3:a:trumpf:trutops_boost:*:*:*:*:*:*:*:*", "matchCriteriaId": "7FE4279B-0D8E-4B0E-8D38-A3AF0C90A0C5", "vulnerable": true}, {"criteria": "cpe:2.3:a:trumpf:trutops_fab:*:*:*:*:*:*:*:*", "matchCriteriaId": "52F57117-C6A3-426E-9AE9-E47596BB0E40", "vulnerable": true}, {"criteria": "cpe:2.3:a:trumpf:trutops_monitor:*:*:*:*:*:*:*:*", "matchCriteriaId": "5114C779-4A9D-4F09-AFBD-42DB013E063A", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Multiple Trumpf Products in multiple versions use default privileged Windows users and passwords. An adversary may use these accounts to remotely gain full access to the system."}, {"lang": "es", "value": "Varios productos de Trumpf en m\u00faltiples versiones usan usuarios y contrase\u00f1as privilegiados de Windows por defecto. Un adversario puede usar estas cuentas para conseguir acceso completo al sistema de forma remota"}], "id": "CVE-2022-2052", "lastModified": "2024-11-21T07:00:14.330", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "info@cert.vde.com", "type": "Secondary"}]}, "published": "2022-10-17T09:15:12.150", "references": [{"source": "info@cert.vde.com", "tags": ["Third Party Advisory"], "url": "https://cert.vde.com/en/advisories/VDE-2022-023/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://cert.vde.com/en/advisories/VDE-2022-023/"}], "sourceIdentifier": "info@cert.vde.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "info@cert.vde.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}