CVE-2022-2634 - CVE House

Status published Critical CVE-2022-2634

Digi ConnectPort X2D

10 CVSS

Vulnerability Description

An attacker may be able to execute malicious actions due to the lack of device access protections and device permissions when using the web application. This could lead to uploading python files which can be later executed.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-2634

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Aarón Flecha of S21sec reported this vulnerability to CISA.

References

https://www.cisa.gov/uscert/ics/advisories/icsa-22-216-01

Affected Vendor

Digi

View all reports →

Affected Software

ConnectPort X2D

Vulnerable Versions:

All manufactured prior to 01/2020

Timeline

Official Publish: August 9th, 2022

Last Modified: April 16th, 2025

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weaknesses (CWE)

CWE-250

MITRE ATT&CK TTPs

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1548 Abuse Elevation Control Mechanism

Defense Evasion

T1078 Valid Accounts

Persistence

T1574 Hijack Execution Flow