CVE-2022-3485 - CVE House
Back to Database
Status published Critical CVE-2022-3485

Weak Password Recovery in ifm moneo appliance

Vulnerability Description

In IFM Moneo Appliance with version up to 1.9.3 an unauthenticated remote attacker can reset the administrator password by only supplying the serial number and thus gain full control of the device.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-3485

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Aimon Dawson

References

More from ifm

View All →
CVE-2024-5404
ifm: moneo prone to weak password recovery mechanism
Critical 9.8
CVE-2024-28751
ifm: Hardcoded telnet credentials in Smart PLC
Critical 9.1
CVE-2024-28750
ifm: Deleting function in Smart PLC allows command injections
High 7.2
CVE-2024-28749
ifm: Writing file function in Smart PLC allows command injections
High 7.2
CVE-2024-28748
ifm: Reading function in Smart PLC allows command injections
High 7.2

Affected Vendor

Affected Software

moneo appliance
Vulnerable Versions:
0

Timeline

Official Publish: December 12th, 2022
Last Modified: April 22nd, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-640

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.