Read the docs
TI-2022-01281 Aliases CVE-2022-1400GHSA-355c-6xpw-m767

Hardcoded encryption key IV in Exago WebReportsApi.dll

Priority MEDIUM 44CWE-321Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-321.

Summary

Use of Hard-coded Cryptographic Key vulnerability in the WebReportsApi.dll of Exago Web Reports, as used in the Device42 Asset Management Appliance, allows an attacker to leak session IDs and elevate privileges. This issue affects: Device42 CMDB versions prior to 18.01.00.

Why it matters now

EPSS 0.0083 57th percentileScored 2026-11-07
Fix Fixed CMDB (Device42): 18.01.00

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Device42CMDBbefore 18.01.0018.01.00Patch availableCNA
  • CMDB VendorDevice42 Affected before 18.01.00 Fixed in 18.01.00 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:device42:cmdb:*:*:*:*:*:*:*:*before 18.01.00VulnerableDevice42
  • cpe:2.3:a:device42:cmdb:*:*:*:*:*:*:*:* Versions before 18.01.00 Vulnerable ·Device42

Remediation

  • Fix · CNA CMDB (Device42) Fixed in 18.01.00

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Device42 CMDB 18.01.00

    4 records Highest priority Priority MEDIUM 4 MEDIUM

    Other records, highest priority first

    • TI-2022-01282 Insufficient validation of provided paths in Exago WrImageResource.axdPriority MEDIUM 51
    • TI-2022-01280 Remote code execution in scheduled tasks componentPriority MEDIUM 41
    • TI-2022-01291 Remote Code Execution in Device42 ApplianceManager consolePriority MEDIUM 40
    Show all 4 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-1400
  2. 2026-10-03 Alias added: GHSA-355c-6xpw-m767

References

Advisory 1

  • TI-2022-01282 Insufficient validation of provided paths in Exago WrImageResource.axd CVSS 3.1HIGH 7.5
  • TI-2022-01280 Remote code execution in scheduled tasks component CVSS 3.1CRITICAL 9.1
  • TI-2022-01291 Remote Code Execution in Device42 ApplianceManager console CVSS 3.1HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences