CVE-2022-50980 MEDIUM

CVE-2022-50980: Multiple Innomic VibroLine VLX and avibia AVLX allow unauthenticated configuration preset change via CAN

Vendor Innomic
Product VibroLine VLX1 HD 5.0
Weakness CWE-306 · Missing auth
Published February 2, 2026
Last update February 2, 2026
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Adjacent
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

What the vulnerability does

01Description

A unauthenticated adjacent attacker could potentially disrupt operations by switching between multiple configuration presets via CAN.

Key dates

02Disclosure timeline

February 2, 2026 CVE published
February 2, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-10672 whuan132 AIBattery com.collweb.AIBatteryHelper BatteryXPCService.swift missing authentication CVE-2026-40884 goshs: Empty-username SFTP password authentication bypass in goshs CVE-2026-23693 ElementsKit Elementor Addons < 3.7.9 Unauthenticated Mailchimp REST Endpoint CVE-2022-34858 WordPress OAuth 2.0 client for SSO plugin <= 1.11.3 - Authentication Bypass vulnerability CVE-2026-44338 PraisonAI ships and generates a legacy API server with authentication disabled by default, allowing unauthenticated workflow execution