{"cve":"CVE-2022-2338","nvd":{"published":"2022-08-17T21:15:09.270","modified":"2026-06-17T04:41:43.290","status":"Modified","description":"Softing Secure Integration Server V1.22 is vulnerable to authentication bypass via a machine-in-the-middle attack. The default the administration interface is accessible via plaintext HTTP protocol, facilitating the attack. The HTTP request may contain the session cookie in the request, which may be captured for use in authenticating to the server.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","score":5.3},"cwes":["CWE-319"],"references":["https://industrial.softing.com/fileadmin/psirt/downloads/syt-2022-5.html","https://www.cisa.gov/uscert/ics/advisories/icsa-22-228-04","https://industrial.softing.com/fileadmin/psirt/downloads/syt-2022-5.html","https://www.cisa.gov/uscert/ics/advisories/icsa-22-228-04"],"products":["softing:edgeaggregator","softing:edgeconnector","softing:opc","softing:opc_ua_c\\+\\+_software_development_kit","softing:secure_integration_server","softing:uagates"],"source":"nvd","synced_at":"2026-10-19T21:34:18.502168378+00:00"},"epss":{"cve":"CVE-2022-2338","score":0.00206,"percentile":0.106,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}