CVE-2022-38121 MEDIUM

CVE-2022-38121: POWERCOM CO., LTD. UPSMON PRO - Insufficiently Protected Credentials

Vendor Powercom Co., Ltd.
Product UPSMON PRO
Weakness CWE-522 · Insufficiently protected credentials
Published November 10, 2022
Last update May 1, 2025

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

UPSMON PRO configuration file stores user password in plaintext under public user directory. A remote attacker with general user privilege can access all users‘ and administrators' account names and passwords via this unprotected configuration file.

Key dates

02Disclosure timeline

November 10, 2022 CVE published
May 1, 2025 Record updated