CVE-2022-23178
CVE-2022-23178
Vexday Risk Score
82Fix now
SSVC decision (CISA)
Act
Exploitation + impact → act immediately
Exploit maturity
Functional exploit
Automatable exploit available (Nuclei/Metasploit).
CVSS —EPSS 75.7%KEV nãoPoC públicaNuclei simMetasploit —Patch —
Lifecycle
15 Jan 2022Published on NVD
18 Jan 2022Public PoC
Weaponization speed
2 daysto first PoC
Weaponized quickly — attackers prioritized this vulnerability. Patch urgently.
Recommendation: Patch as soon as possible — active exploitation confirmed.
An issue was discovered on Crestron HD-MD4X2-4K-E 1.0.0.2159 devices. When the administrative web interface of the HDMI switcher is accessed unauthenticated, user credentials are disclosed that are valid to authenticate to the web interface. Specifically, aj.html sends a JSON document with uname and upassword fields.
Affected products
n/a · n/apublic PoCs found — 1
exploitdbwww.exploit-db.com/exploits/50675unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.