CVE-2022-1399
CVE-2022-1399 is a critical-severity vulnerability in Device42 Cmdb with a CVSS 3.x base score of 9.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-88.
Key facts
- Severity: Critical (CVSS 3.x base score 9.1)
- EPSS exploit prediction: 1% (52nd percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-88
- Affected product: Device42 Cmdb
- Published:
- Last modified:
Description
An Argument Injection or Modification vulnerability in the "Change Secret" username field as used in the Discovery component of Device42 CMDB allows a local attacker to run arbitrary code on the appliance with root privileges. This issue affects: Device42 CMDB version 18.01.00 and prior versions.
Frequently asked questions
- What is CVE-2022-1399?
- An Argument Injection or Modification vulnerability in the "Change Secret" username field as used in the Discovery component of Device42 CMDB allows a local attacker to run arbitrary code on the appliance with root privileges. This issue affects: Device42 CMDB version 18.01.00 and prior versions.
- How severe is CVE-2022-1399?
- CVE-2022-1399 has a CVSS 3.x base score of 9.1, rated critical severity. It is exploitable over network with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
- Is CVE-2022-1399 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (52nd percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2022-1399?
- CVE-2022-1399 affects Device42 Cmdb. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2022-1399?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
- When was CVE-2022-1399 published?
- CVE-2022-1399 was published on 2022-08-17 and last updated on 2026-06-17.
References
Affected products (1)
- cpe:2.3:a:device42:cmdb:*:*:*:*:*:*:*:*
More vulnerabilities in Device42 Cmdb
- CVE-2022-1410 — High (CVSS 8.0): OS Command Injection vulnerability in the db_optimize component of Device42 Asset Management Appliance allows an…
- CVE-2022-1400 — High (CVSS 7.1): Use of Hard-coded Cryptographic Key vulnerability in the WebReportsApi.dll of Exago Web Reports, as used in the…
- CVE-2022-1401 — Medium (CVSS 6.9): Improper Access Control vulnerability in the /Exago/WrImageResource.adx route as used in Device42 Asset Management…
All CVEs affecting Device42 Cmdb →
Other CWE-88 (Argument Injection) vulnerabilities
- CVE-2026-57572 — Critical (CVSS 10.0): Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, the Docker API server accepted…
- CVE-2026-40281 — Critical (CVSS 10.0): Gotenberg is a Docker-powered stateless API for PDF files. In versions 8.30.1 and earlier, the metadata write endpoint…
- CVE-2023-6269 — Critical (CVSS 10.0): An argument injection vulnerability has been identified in the administrative web interface of the Atos Unify…
- CVE-2007-0882 — Critical (CVSS 10.0): Argument injection vulnerability in the telnet daemon (in.telnetd) in Solaris 10 and 11 (SunOS 5.10 and 5.11)…
- CVE-2004-0480 — Critical (CVSS 10.0): Argument injection vulnerability in IBM Lotus Notes 6.0.3 and 6.5 allows remote attackers to execute arbitrary code via…
- CVE-1999-0113 — Critical (CVSS 10.0): Some implementations of rlogin allow root access if given a -froot parameter.