Read the docs
TI-2022-26427 Aliases CVE-2022-50976GHSA-jh3j-gc93-659h

Innomic VibroLine Configurator and avibia Configurator allow unintended device reset via USB

Priority LOW 33CWE-1288Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

A local attacker could cause a full device reset by resetting the device passwords using an invalid reset file via USB.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00154 4th percentileScored 2026-11-07
Fix Fixed VibroLine Configurator 5.0 (Innomic): 5.1.2730AvibiaLine Configurator 5.0 (avibia): 5.1.2730+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
InnomicVibroLine Configurator 5.05.0.2416 – 5.0.24865.1.2730Patch availableCNA
avibiaAvibiaLine Configurator 5.05.0.2416 – 5.0.24865.1.2730Patch availableCNA
InnomicVibroLine Configurator 4.0—4.0.1931Patch availableCNA
  • VibroLine Configurator 5.0 VendorInnomic Affected 5.0.2416 – 5.0.2486 Fixed in 5.1.2730 Patch available CNA
  • AvibiaLine Configurator 5.0 Vendoravibia Affected 5.0.2416 – 5.0.2486 Fixed in 5.1.2730 Patch available CNA
  • VibroLine Configurator 4.0 VendorInnomic Affected — Fixed in 4.0.1931 Patch available CNA

Remediation

  • Fix · CNA VibroLine Configurator 5.0 (Innomic) Fixed in 5.1.2730
  • Fix · CNA AvibiaLine Configurator 5.0 (avibia) Fixed in 5.1.2730
  • Fix · CNA VibroLine Configurator 4.0 (Innomic) Fixed in 4.0.1931

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-50976
  2. 2026-10-03 Alias added: GHSA-jh3j-gc93-659h

References

Advisory 2

  • TI-2022-26432 Multiple Innomic VibroLine VLX HD 5.0 and avibia AVLX weak password requirements CVSS 3.1CRITICAL 9.8
  • TI-2022-26426 Multiple Innomic VibroLine VLX and avibia AVLX allow unauthenticated access to device configuration CVSS 3.1HIGH 8.8
  • TI-2022-26429 Multiple Innomic VibroLine VLX and avibia AVLX allow unauthenticated configuration preset change via Modbus (TCP) CVSS 3.1HIGH 7.5
  • TI-2022-26428 Multiple Innomic VibroLine VLX and avibia AVLX allow unauthenticated configuration preset change via HTTP CVSS 3.1HIGH 7.5
  • TI-2022-26431 Multiple Innomic VibroLine VLX and avibia AVLX allow unauthenticated configuration preset change via CAN CVSS 3.1MEDIUM 6.5
  • TI-2022-26430 Multiple Innomic VibroLine VLX and avibia AVLX allow unauthenticated configuration preset change via Modbus (RS485) CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences