CVE-2022-1368 CRITICAL

CVE-2022-1368: Cognex 3D-A1000 Dimensioning System Missing Authentication for Critical Function

Vendor Cognex
Product 3D-A1000 Dimensioning System
Weakness CWE-306 · Missing auth
Published September 6, 2022
Last update April 16, 2025
View on NVD All CVEs

CVSS base score

9.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

The Cognex 3D-A1000 Dimensioning System in firmware version 1.0.3 (3354) and prior is vulnerable to CWE-306: Missing Authentication for Critical Function, which allows unauthorized users to change the operator account password via webserver commands by monitoring web socket communications from an unauthenticated session. This could allow an attacker to escalate privileges to match those of the compromised account.

Key dates

02Disclosure timeline

September 6, 2022 CVE published
April 16, 2025 Record updated