Read the docs
TI-2022-02776 Aliases CVE-2022-3010GHSA-x5gw-mqgf-fwh3

Predictable SSH credentials in Priva TopControl Suite

Priority MEDIUM 40CWE-1391Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

The Priva TopControl Suite contains predictable credentials for the SSH service, based on the Serial number. Which makes it possible for an attacker to calculate the login credentials for the Priva TopControll suite.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00584 48th percentileScored 2026-11-07
Fix Fixed TopControl Suite - Bacnet (Priva): 8.7.8.0TopControl Suite - Blue ID (Priva): 8.7.8.0+3 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
PrivaTopControl Suite - BacnetAll versions prior to 8.7.8.0 to before 8.7.8.08.7.8.0Patch availableCNA
PrivaTopControl Suite - Blue IDAll versions prior to 8.7.8.0 to before 8.7.8.08.7.8.0Patch availableCNA
PrivaTopControl Suite - CompassAll versions prior to 8.7.8.0 to before 8.7.8.08.7.8.0Patch availableCNA
PrivaTopControl Suite - ConnectAll versions prior to 8.7.8.0 to before 8.7.8.08.7.8.0Patch availableCNA
PrivaTopControl Suite - TPCAll versions prior to 8.7.8.0 to before 8.7.8.08.7.8.0Patch availableCNA
  • TopControl Suite - Bacnet VendorPriva Affected All versions prior to 8.7.8.0 to before 8.7.8.0 Fixed in 8.7.8.0 Patch available CNA
  • TopControl Suite - Blue ID VendorPriva Affected All versions prior to 8.7.8.0 to before 8.7.8.0 Fixed in 8.7.8.0 Patch available CNA
  • TopControl Suite - Compass VendorPriva Affected All versions prior to 8.7.8.0 to before 8.7.8.0 Fixed in 8.7.8.0 Patch available CNA
  • TopControl Suite - Connect VendorPriva Affected All versions prior to 8.7.8.0 to before 8.7.8.0 Fixed in 8.7.8.0 Patch available CNA
  • TopControl Suite - TPC VendorPriva Affected All versions prior to 8.7.8.0 to before 8.7.8.0 Fixed in 8.7.8.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:priva:top_control_suite:*:*:*:*:*:*:*:*up to 8.7.8.0VulnerablePriva
  • cpe:2.3:a:priva:top_control_suite:*:*:*:*:*:*:*:* Versions up to 8.7.8.0 Vulnerable ·Priva

Remediation

  • Fix · CNA TopControl Suite - Bacnet (Priva) Fixed in 8.7.8.0
  • Fix · CNA TopControl Suite - Blue ID (Priva) Fixed in 8.7.8.0
  • Fix · CNA TopControl Suite - Compass (Priva) Fixed in 8.7.8.0
  • Fix · CNA TopControl Suite - Connect (Priva) Fixed in 8.7.8.0
  • Fix · CNA TopControl Suite - TPC (Priva) Fixed in 8.7.8.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-3010
  2. 2026-10-03 Alias added: GHSA-x5gw-mqgf-fwh3

References

Advisory 2

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences