CVE-2022-50981: Missing Authentication (CWE-306) in Devices Shipped Without Default Password
CVE-2022-50981 is a critical missing-authentication weakness (CWE-306) in devices shipped without a password by default, and the record states that setting one is not enforced. According to the record, an unauthenticated remote attacker could gain full access to affected devices. CISA KEV does not list this CVE and no confirmed exploitation appears in the sources consulted, while the record does not state affected or fixed versions.
Overview
CVE-2022-50981 is a critical missing-authentication issue (CWE-306) affecting devices that are shipped without a password by default, with no enforcement that one is set. The record was published by the CNA info@cert.vde.com with a CVSS 3.1 base score of 9.8. Two advisory references point to an Innomic CSAF document, IDS-2026-0001, which appears to be the vendor source.
Impact
According to the record, an unauthenticated remote attacker can gain full access to the affected devices. The CVSS 3.1 vector in the record describes network reachability, low complexity, no privileges required and no user interaction, with high impact to confidentiality, integrity and availability.
Affected products and versions
The record does not list any affected products or versions, and no fixed versions are listed. The vendor advisory linked in the references should be consulted for product and version details, which this analysis does not state.
Exploitation status
This CVE is not listed in the CISA KEV catalog in the record, and no confirmed exploitation appears in the sources consulted. EPSS data is not available in the record.
Remediation and mitigation
- Consult the vendor advisory for authoritative remediation guidance and any updated firmware or configuration.
- Where devices are deployed without a password, set a strong, unique credential as soon as the vendor's documented procedure allows.
- Restrict network access to management interfaces to trusted administrative networks, and segment industrial devices from untrusted networks.
- Inventory devices from this vendor and prioritize those reachable from untrusted networks.
Detection guidance
- Review asset inventories to identify devices from the vendor and whether they still use their default configuration.
- Monitor for unexpected logins or configuration changes on management interfaces.
- Log and alert on access attempts to administrative services from unexpected sources.
Limitations of the available information
The record contains no affected version list, no fixed version list and no CNA-provided title. The vendor name is inferred from the advisory domain rather than stated in the record. Whether a fix exists is unknown from the record, so the vendor advisory must be checked directly.
Frequently asked questions
What is the core problem in CVE-2022-50981?
The devices are shipped without a password by default and the product does not enforce setting one, so an unauthenticated remote attacker may gain full access according to the record.
Is this CVE known to be actively exploited?
No. The record shows it is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.