CVE-2022-2474 - CVE House
Back to Database
Status published Critical CVE-2022-2474

Authentication is currently unsupported in Haas Controller version 100.20.000.1110 when...

Vulnerability Description

Authentication is currently unsupported in Haas Controller version 100.20.000.1110 when using the “Ethernet Q Commands” service, which allows any user on the same network segment as the controller (even while connected remotely) to access the service and write unauthorized macros to the device.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-2474

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Marco Balduzzi of Trend Micro and Francesco Sortino from Celada Spa reported this vulnerability.

References

More from Haas

View All →
CVE-2022-41636
Communication traffic involving "Ethernet Q Commands" service of Haas Controller...
Critical 9.1
CVE-2022-2475
Haas Controller version 100.20.000.1110 has insufficient granularity of access control...
Critical 9.8

Affected Vendor

Affected Software

Haas CNC Controller
Vulnerable Versions:
Version 100.20.000.1110

Timeline

Official Publish: October 28th, 2022
Last Modified: April 16th, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-306

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1078 Valid Accounts
Persistence
T1136 Create Account
Persistence
T1098 Account Manipulation
Privilege Escalation
T1021 Remote Services
Lateral Movement