CVE-2022-2052

TRUMPF TruTops default user accounts vulnerability

View on CVE.org

Published Oct 17, 2022 CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Description

Multiple Trumpf Products in multiple versions use default privileged Windows users and passwords. An adversary may use these accounts to remotely gain full access to the system.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

TRUMPF Werkzeugmaschinen SE + Co. KG

TruTops Monitor

affected

Version	Status	Constraints
`All Versions`	affected	—

TRUMPF Werkzeugmaschinen SE + Co. KG

TruTops Fab

affected

Version	Status	Constraints
`All Versions`	affected	—

TRUMPF Werkzeugmaschinen SE + Co. KG

Oseon

affected

Version	Status	Constraints
`unspecified`	affected	≤ 1.6

TRUMPF Werkzeugmaschinen SE + Co. KG

Job Order Interface

affected

Version	Status	Constraints
`All Versions`	affected	—

TRUMPF Werkzeugmaschinen SE + Co. KG

TruTops Boost with option Inventory of sheets and remainder sheets

affected

Version	Status	Constraints
`All Versions`	affected	—

TRUMPF Werkzeugmaschinen SE + Co. KG

TruTops Boost with option Graphic separation of cut parts

affected

Version	Status	Constraints
`All Versions`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:trumpf:job_order_interface::::::::
	cpe:2.3:a:trumpf:oseon::::::::
	cpe:2.3:a:trumpf:trutops_boost::::::::
	cpe:2.3:a:trumpf:trutops_fab::::::::
	cpe:2.3:a:trumpf:trutops_monitor::::::::

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
EUVD	EUVD-2022-34353	Multiple Trumpf Products in multiple versions use default privileged Windows users and passwords. An adversary may use these accounts to remotely gain full access to the system.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.768% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://cert.vde.com/en/advisories/VDE-2022-023/

History

Jul 12, 2025 1:45 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00082}`	epss `{'score': 0.00103}`

May 10, 2025 3:15 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Subscriptions

Trumpf Job Order Interface Oseon Trutops Boost Trutops Fab Trutops Monitor

Weaknesses

Sources

CVE record Updated: May 10, 2025, 2:57 AM

Status: PUBLISHED
Assigner: CERTVDE
Published: Oct 17, 2022, 8:20 AM
Updated: May 10, 2025, 2:57 AM
Reserved: Jun 10, 2022, 12:00 AM

View source JSON

Vulnrichment Updated: Aug 3, 2024, 12:24 AM

Updated: Aug 3, 2024, 12:24 AM

NVD Updated: Jun 17, 2026, 4:41 AM

Status: Modified
Published: Oct 17, 2022, 9:15 AM
Modified: Jun 17, 2026, 4:41 AM

View source JSON

Red Hat No data

No data.

OpenCVE enrichment No data

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-2052", "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "assignerShortName": "CERTVDE", "datePublished": "2022-10-17T08:20:11.346Z", "dateUpdated": "2025-05-10T02:57:40.699Z", "dateReserved": "2022-06-10T00:00:00.000Z"}, "containers": {"cna": {"title": "TRUMPF TruTops default user accounts vulnerability", "datePublic": "2022-10-17T00:00:00.000Z", "providerMetadata": {"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "shortName": "CERTVDE", "dateUpdated": "2022-10-17T00:00:00.000Z"}, "descriptions": [{"lang": "en", "value": "Multiple Trumpf Products in multiple versions use default privileged Windows users and passwords. An adversary may use these accounts to remotely gain full access to the system."}], "affected": [{"vendor": "TRUMPF Werkzeugmaschinen SE + Co. KG", "product": "TruTops Monitor", "versions": [{"version": "All Versions", "status": "affected"}]}, {"vendor": "TRUMPF Werkzeugmaschinen SE + Co. KG", "product": "TruTops Fab", "versions": [{"version": "All Versions", "status": "affected"}]}, {"vendor": "TRUMPF Werkzeugmaschinen SE + Co. KG", "product": "Oseon", "versions": [{"version": "unspecified", "lessThanOrEqual": "1.6", "status": "affected", "versionType": "custom"}]}, {"vendor": "TRUMPF Werkzeugmaschinen SE + Co. KG", "product": "Job Order Interface", "versions": [{"version": "All Versions", "status": "affected"}]}, {"vendor": "TRUMPF Werkzeugmaschinen SE + Co. KG", "product": "TruTops Boost with option Inventory of sheets and remainder sheets", "versions": [{"version": "All Versions", "status": "affected"}]}, {"vendor": "TRUMPF Werkzeugmaschinen SE + Co. KG", "product": "TruTops Boost with option Graphic separation of cut parts", "versions": [{"version": "All Versions", "status": "affected"}]}], "references": [{"url": "https://cert.vde.com/en/advisories/VDE-2022-023/"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-284 Improper Access Control", "cweId": "CWE-284"}]}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "source": {"advisory": "VDE-2022-023", "defect": ["CERT@VDE#64131"], "discovery": "INTERNAL"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T00:24:44.261Z"}, "title": "CVE Program Container", "references": [{"url": "https://cert.vde.com/en/advisories/VDE-2022-023/", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-05-10T02:57:27.303845Z", "id": "CVE-2022-2052", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-10T02:57:40.699Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://cert.vde.com/en/advisories/VDE-2022-023/", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T00:24:44.261Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-2052", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-05-10T02:57:27.303845Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-10T02:57:35.935Z"}}], "cna": {"title": "TRUMPF TruTops default user accounts vulnerability", "source": {"defect": ["CERT@VDE#64131"], "advisory": "VDE-2022-023", "discovery": "INTERNAL"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "TRUMPF Werkzeugmaschinen SE + Co. KG", "product": "TruTops Monitor", "versions": [{"status": "affected", "version": "All Versions"}]}, {"vendor": "TRUMPF Werkzeugmaschinen SE + Co. KG", "product": "TruTops Fab", "versions": [{"status": "affected", "version": "All Versions"}]}, {"vendor": "TRUMPF Werkzeugmaschinen SE + Co. KG", "product": "Oseon", "versions": [{"status": "affected", "version": "unspecified", "versionType": "custom", "lessThanOrEqual": "1.6"}]}, {"vendor": "TRUMPF Werkzeugmaschinen SE + Co. KG", "product": "Job Order Interface", "versions": [{"status": "affected", "version": "All Versions"}]}, {"vendor": "TRUMPF Werkzeugmaschinen SE + Co. KG", "product": "TruTops Boost with option Inventory of sheets and remainder sheets", "versions": [{"status": "affected", "version": "All Versions"}]}, {"vendor": "TRUMPF Werkzeugmaschinen SE + Co. KG", "product": "TruTops Boost with option Graphic separation of cut parts", "versions": [{"status": "affected", "version": "All Versions"}]}], "datePublic": "2022-10-17T00:00:00.000Z", "references": [{"url": "https://cert.vde.com/en/advisories/VDE-2022-023/"}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "descriptions": [{"lang": "en", "value": "Multiple Trumpf Products in multiple versions use default privileged Windows users and passwords. An adversary may use these accounts to remotely gain full access to the system."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284 Improper Access Control"}]}], "providerMetadata": {"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "shortName": "CERTVDE", "dateUpdated": "2022-10-17T00:00:00.000Z"}}}, "cveMetadata": {"cveId": "CVE-2022-2052", "state": "PUBLISHED", "dateUpdated": "2025-05-10T02:57:40.699Z", "dateReserved": "2022-06-10T00:00:00.000Z", "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "datePublished": "2022-10-17T08:20:11.346Z", "assignerShortName": "CERTVDE"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "TruTops Monitor", "vendor": "TRUMPF Werkzeugmaschinen SE + Co. KG", "versions": [{"status": "affected", "version": "All Versions"}]}, {"product": "TruTops Fab", "vendor": "TRUMPF Werkzeugmaschinen SE + Co. KG", "versions": [{"status": "affected", "version": "All Versions"}]}, {"product": "Oseon", "vendor": "TRUMPF Werkzeugmaschinen SE + Co. KG", "versions": [{"lessThanOrEqual": "1.6", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "Job Order Interface", "vendor": "TRUMPF Werkzeugmaschinen SE + Co. KG", "versions": [{"status": "affected", "version": "All Versions"}]}, {"product": "TruTops Boost with option Inventory of sheets and remainder sheets", "vendor": "TRUMPF Werkzeugmaschinen SE + Co. KG", "versions": [{"status": "affected", "version": "All Versions"}]}, {"product": "TruTops Boost with option Graphic separation of cut parts", "vendor": "TRUMPF Werkzeugmaschinen SE + Co. KG", "versions": [{"status": "affected", "version": "All Versions"}]}], "source": "info@cert.vde.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:trumpf:job_order_interface:*:*:*:*:*:*:*:*", "matchCriteriaId": "23618C14-F7A5-46D5-9861-1439F197622A", "vulnerable": true}, {"criteria": "cpe:2.3:a:trumpf:oseon:*:*:*:*:*:*:*:*", "matchCriteriaId": "806F1D17-51DF-431D-B34B-7EC4FA7D5873", "versionEndIncluding": "1.6", "vulnerable": true}, {"criteria": "cpe:2.3:a:trumpf:trutops_boost:*:*:*:*:*:*:*:*", "matchCriteriaId": "7FE4279B-0D8E-4B0E-8D38-A3AF0C90A0C5", "vulnerable": true}, {"criteria": "cpe:2.3:a:trumpf:trutops_fab:*:*:*:*:*:*:*:*", "matchCriteriaId": "52F57117-C6A3-426E-9AE9-E47596BB0E40", "vulnerable": true}, {"criteria": "cpe:2.3:a:trumpf:trutops_monitor:*:*:*:*:*:*:*:*", "matchCriteriaId": "5114C779-4A9D-4F09-AFBD-42DB013E063A", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Multiple Trumpf Products in multiple versions use default privileged Windows users and passwords. An adversary may use these accounts to remotely gain full access to the system."}, {"lang": "es", "value": "Varios productos de Trumpf en m\u00faltiples versiones usan usuarios y contrase\u00f1as privilegiados de Windows por defecto. Un adversario puede usar estas cuentas para conseguir acceso completo al sistema de forma remota"}], "id": "CVE-2022-2052", "lastModified": "2026-06-17T04:41:11.803", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "info@cert.vde.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2022-2052", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-05-10T02:57:27.303845Z", "version": "2.0.3"}}]}, "published": "2022-10-17T09:15:12.150", "references": [{"source": "info@cert.vde.com", "tags": ["Third Party Advisory"], "url": "https://cert.vde.com/en/advisories/VDE-2022-023/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://cert.vde.com/en/advisories/VDE-2022-023/"}], "sourceIdentifier": "info@cert.vde.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "info@cert.vde.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}