2.2.7 AUTHENTICATION BYPASS BY SPOOFING CWE-290
Priority LOW 32CWE-290Published · Updated
Key facts
- Attack vector
- Physical
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-290.
Summary
The authentication mechanism used by technicians on the tested version of Dominion Voting Systems ImageCast X is susceptible to forgery. An attacker with physical access may use this to gain administrative privileges on a device and install malicious code or perform arbitrary administrative actions.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00294 22nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Dominion Voting Systems | ImageCast X application | Version 5.5-A Versions 5.5.10.30 and 5.5.10.32 | — | No fix listed | CNA |
| Dominion Voting Systems | ImageCast X firmware | Version 5.5-A | — | No fix listed | CNA |
- ImageCast X application VendorDominion Voting Systems Affected Version 5.5-A Versions 5.5.10.30 and 5.5.10.32 Fixed in — No fix listed CNA
- ImageCast X firmware VendorDominion Voting Systems Affected Version 5.5-A Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:dominionvoting:imagecast_x:*:*:*:*:*:*:*:* | all versions | Vulnerable | Dominion Voting Systems |
| cpe:2.3:h:dominionvoting:democracy_suite:5.5-a:*:*:*:*:*:*:* | 5.5-a | Running on | Dominion Voting Systems |
| cpe:2.3:a:dominionvoting:imagecast_x:5.5.10.30:*:*:*:*:*:*:* | 5.5.10.30 | Vulnerable | Dominion Voting Systems |
| cpe:2.3:a:dominionvoting:imagecast_x:5.5.10.32:*:*:*:*:*:*:* | 5.5.10.32 | Vulnerable | Dominion Voting Systems |
- cpe:2.3:o:dominionvoting:imagecast_x:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Dominion Voting Systems
- cpe:2.3:h:dominionvoting:democracy_suite:5.5-a:*:*:*:*:*:*:* Versions 5.5-a Running on ·Dominion Voting Systems
- cpe:2.3:a:dominionvoting:imagecast_x:5.5.10.30:*:*:*:*:*:*:* Versions 5.5.10.30 Vulnerable ·Dominion Voting Systems
- cpe:2.3:a:dominionvoting:imagecast_x:5.5.10.32:*:*:*:*:*:*:* Versions 5.5.10.32 Vulnerable ·Dominion Voting Systems
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2022-1745
- 2026-10-03 Alias added: GHSA-rg2m-7v6j-w3wq
References
More Dominion Voting Systems Imagecast X vulnerabilities
- TI-2022-01612 2.2.8 INCORRECT PRIVILEGE ASSIGNMENT CWE-266 CVSS 3.1HIGH 7.6
- TI-2022-01610 2.2.6 EXECUTION WITH UNNECESSARY PRIVILEGES CWE-250 CVSS 3.1MEDIUM 6.8
- TI-2022-01609 2.2.5 PATH TRAVERSAL: '../FILEDIR' CWE-24 CVSS 3.1MEDIUM 6.8
- TI-2022-01608 2.2.4 IMPROPER PROTECTION OF ALTERNATE PATH CWE-424 CVSS 3.1MEDIUM 6.8
- TI-2022-01607 2.2.3 HIDDEN FUNCTIONALITY CWE-912 CVSS 3.1MEDIUM 6.8
- TI-2022-01605 2.2.1 IMPROPER VERIFICATION OF CRYPTOGRAPHIC SIGNATURE CWE-347 CVSS 3.1MEDIUM 6.8
Sources
- CVE-2022-1745 · CVE Program
- CVE-2022-1745 · NVD
- FIRST EPSS
- GHSA-rg2m-7v6j-w3wq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences