Read the docs
TI-2022-26429 Aliases CVE-2022-50978GHSA-vcc2-8qcw-j2m8

Multiple Innomic VibroLine VLX and avibia AVLX allow unauthenticated configuration preset change via Modbus (TCP)

Priority LOW 39CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

An unauthenticated remote attacker could potentially disrupt operations by switching between multiple configuration presets via Modbus (TCP).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00499 43rd percentileScored 2026-11-07
Fix Fixed VibroLine VLE1 HD 5.0 (Innomic): 2.1.1340, 2.1.1866VibroLine VLE2 HD 5.0 (Innomic): 2.1.1340, 2.1.1866+18 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
InnomicVibroLine VLX1 HD 5.02.1.1340 – 2.1.1387; 2.1.1866—No fix listedCNA
InnomicVibroLine VLX2 HD 5.02.1.1340 – 2.1.1387; 2.1.1866—No fix listedCNA
InnomicVibroLine VLX4 HD 5.02.1.1340 – 2.1.1387; 2.1.1866—No fix listedCNA
InnomicVibroLine VLX6 HD 5.02.1.1340 – 2.1.1387; 2.1.1866—No fix listedCNA
InnomicVibroLine VLX8 HD 5.02.1.1340 – 2.1.1387; 2.1.1866—No fix listedCNA
avibiaAvibiaLine AVLX1 HD 5.02.1.1340 – 2.1.1387; 2.1.1866—No fix listedCNA
avibiaAvibiaLine AVLX2 HD 5.02.1.1340 – 2.1.1387; 2.1.1866—No fix listedCNA
avibiaAvibiaLine AVLX4 HD 5.02.1.1340 – 2.1.1387; 2.1.1866—No fix listedCNA
avibiaAvibiaLine AVLX6 HD 5.02.1.1340 – 2.1.1387; 2.1.1866—No fix listedCNA
avibiaAvibiaLine AVLX8 HD 5.02.1.1340 – 2.1.1387; 2.1.1866—No fix listedCNA
InnomicVibroLine VLE1 HD 5.0—2.1.1340Patch availableCNA
InnomicVibroLine VLE2 HD 5.0—2.1.1340Patch availableCNA
InnomicVibroLine VLE4 HD 5.0—2.1.1340Patch availableCNA
InnomicVibroLine VLE6 HD 5.0—2.1.1340Patch availableCNA
InnomicVibroLine VLE8 HD 5.0—2.1.1340Patch availableCNA
avibiaAvibiaLine AVLE1 HD 5.0—2.1.1340, 2.1.1866Patch availableCNA
avibiaAvibiaLine AVLE2 HD 5.0—2.1.1340, 2.1.1866Patch availableCNA
avibiaAvibiaLine AVLE4 HD 5.0—2.1.1340, 2.1.1866Patch availableCNA
avibiaAvibiaLine AVLE6 HD 5.0—2.1.1340, 2.1.1866Patch availableCNA
avibiaAvibiaLine AVLE8 HD 5.0—2.1.1340, 2.1.1866Patch availableCNA
InnomicVibroLine VLE1 HD 5.0—2.1.1866Patch availableCNA
InnomicVibroLine VLE2 HD 5.0—2.1.1866Patch availableCNA
InnomicVibroLine VLE4 HD 5.0—2.1.1866Patch availableCNA
InnomicVibroLine VLE6 HD 5.0—2.1.1866Patch availableCNA
InnomicVibroLine VLE8 HD 5.0—2.1.1866Patch availableCNA
InnomicVibroLine VLE1 HD 4.0—1.4.1074Patch availableCNA
InnomicVibroLine VLE2 HD 4.0—1.4.1074Patch availableCNA
InnomicVibroLine VLE4 HD 4.0—1.4.1074Patch availableCNA
InnomicVibroLine VLE6 HD 4.0—1.4.1074Patch availableCNA
InnomicVibroLine VLE8 HD 4.0—1.4.1074Patch availableCNA
InnomicVibroLine VLX1 HD 4.0—1.5.1074Patch availableCNA
InnomicVibroLine VLX2 HD 4.0—1.5.1074Patch availableCNA
InnomicVibroLine VLX4 HD 4.0—1.5.1074Patch availableCNA
InnomicVibroLine VLX6 HD 4.0—1.5.1074Patch availableCNA
InnomicVibroLine VLX8 HD 4.0—1.5.1074Patch availableCNA
  • VibroLine VLX1 HD 5.0 VendorInnomic Affected 2.1.1340 – 2.1.1387; 2.1.1866 Fixed in — No fix listed CNA
  • VibroLine VLX2 HD 5.0 VendorInnomic Affected 2.1.1340 – 2.1.1387; 2.1.1866 Fixed in — No fix listed CNA
  • VibroLine VLX4 HD 5.0 VendorInnomic Affected 2.1.1340 – 2.1.1387; 2.1.1866 Fixed in — No fix listed CNA
  • VibroLine VLX6 HD 5.0 VendorInnomic Affected 2.1.1340 – 2.1.1387; 2.1.1866 Fixed in — No fix listed CNA
  • VibroLine VLX8 HD 5.0 VendorInnomic Affected 2.1.1340 – 2.1.1387; 2.1.1866 Fixed in — No fix listed CNA
  • AvibiaLine AVLX1 HD 5.0 Vendoravibia Affected 2.1.1340 – 2.1.1387; 2.1.1866 Fixed in — No fix listed CNA
  • AvibiaLine AVLX2 HD 5.0 Vendoravibia Affected 2.1.1340 – 2.1.1387; 2.1.1866 Fixed in — No fix listed CNA
  • AvibiaLine AVLX4 HD 5.0 Vendoravibia Affected 2.1.1340 – 2.1.1387; 2.1.1866 Fixed in — No fix listed CNA
  • AvibiaLine AVLX6 HD 5.0 Vendoravibia Affected 2.1.1340 – 2.1.1387; 2.1.1866 Fixed in — No fix listed CNA
  • AvibiaLine AVLX8 HD 5.0 Vendoravibia Affected 2.1.1340 – 2.1.1387; 2.1.1866 Fixed in — No fix listed CNA
  • VibroLine VLE1 HD 5.0 VendorInnomic Affected — Fixed in 2.1.1340 Patch available CNA
  • VibroLine VLE2 HD 5.0 VendorInnomic Affected — Fixed in 2.1.1340 Patch available CNA
  • VibroLine VLE4 HD 5.0 VendorInnomic Affected — Fixed in 2.1.1340 Patch available CNA
  • VibroLine VLE6 HD 5.0 VendorInnomic Affected — Fixed in 2.1.1340 Patch available CNA
  • VibroLine VLE8 HD 5.0 VendorInnomic Affected — Fixed in 2.1.1340 Patch available CNA
  • AvibiaLine AVLE1 HD 5.0 Vendoravibia Affected — Fixed in 2.1.1340, 2.1.1866 Patch available CNA
  • AvibiaLine AVLE2 HD 5.0 Vendoravibia Affected — Fixed in 2.1.1340, 2.1.1866 Patch available CNA
  • AvibiaLine AVLE4 HD 5.0 Vendoravibia Affected — Fixed in 2.1.1340, 2.1.1866 Patch available CNA
  • AvibiaLine AVLE6 HD 5.0 Vendoravibia Affected — Fixed in 2.1.1340, 2.1.1866 Patch available CNA
  • AvibiaLine AVLE8 HD 5.0 Vendoravibia Affected — Fixed in 2.1.1340, 2.1.1866 Patch available CNA
  • VibroLine VLE1 HD 5.0 VendorInnomic Affected — Fixed in 2.1.1866 Patch available CNA
  • VibroLine VLE2 HD 5.0 VendorInnomic Affected — Fixed in 2.1.1866 Patch available CNA
  • VibroLine VLE4 HD 5.0 VendorInnomic Affected — Fixed in 2.1.1866 Patch available CNA
  • VibroLine VLE6 HD 5.0 VendorInnomic Affected — Fixed in 2.1.1866 Patch available CNA
  • VibroLine VLE8 HD 5.0 VendorInnomic Affected — Fixed in 2.1.1866 Patch available CNA
  • VibroLine VLE1 HD 4.0 VendorInnomic Affected — Fixed in 1.4.1074 Patch available CNA
  • VibroLine VLE2 HD 4.0 VendorInnomic Affected — Fixed in 1.4.1074 Patch available CNA
  • VibroLine VLE4 HD 4.0 VendorInnomic Affected — Fixed in 1.4.1074 Patch available CNA
  • VibroLine VLE6 HD 4.0 VendorInnomic Affected — Fixed in 1.4.1074 Patch available CNA
  • VibroLine VLE8 HD 4.0 VendorInnomic Affected — Fixed in 1.4.1074 Patch available CNA
  • VibroLine VLX1 HD 4.0 VendorInnomic Affected — Fixed in 1.5.1074 Patch available CNA
  • VibroLine VLX2 HD 4.0 VendorInnomic Affected — Fixed in 1.5.1074 Patch available CNA
  • VibroLine VLX4 HD 4.0 VendorInnomic Affected — Fixed in 1.5.1074 Patch available CNA
  • VibroLine VLX6 HD 4.0 VendorInnomic Affected — Fixed in 1.5.1074 Patch available CNA
  • VibroLine VLX8 HD 4.0 VendorInnomic Affected — Fixed in 1.5.1074 Patch available CNA

Remediation

  • Fix · CNA VibroLine VLE1 HD 5.0 (Innomic) Fixed in 2.1.1340
  • Fix · CNA VibroLine VLE2 HD 5.0 (Innomic) Fixed in 2.1.1340
  • Fix · CNA VibroLine VLE4 HD 5.0 (Innomic) Fixed in 2.1.1340
  • Fix · CNA VibroLine VLE6 HD 5.0 (Innomic) Fixed in 2.1.1340
  • Fix · CNA VibroLine VLE8 HD 5.0 (Innomic) Fixed in 2.1.1340
  • Fix · CNA AvibiaLine AVLE1 HD 5.0 (avibia) Fixed in 2.1.1340, 2.1.1866
  • Fix · CNA AvibiaLine AVLE2 HD 5.0 (avibia) Fixed in 2.1.1340, 2.1.1866
  • Fix · CNA AvibiaLine AVLE4 HD 5.0 (avibia) Fixed in 2.1.1340, 2.1.1866
  • Fix · CNA AvibiaLine AVLE6 HD 5.0 (avibia) Fixed in 2.1.1340, 2.1.1866
  • Fix · CNA AvibiaLine AVLE8 HD 5.0 (avibia) Fixed in 2.1.1340, 2.1.1866
  • Fix · CNA VibroLine VLE1 HD 5.0 (Innomic) Fixed in 2.1.1866
  • Fix · CNA VibroLine VLE2 HD 5.0 (Innomic) Fixed in 2.1.1866
  • Fix · CNA VibroLine VLE4 HD 5.0 (Innomic) Fixed in 2.1.1866
  • Fix · CNA VibroLine VLE6 HD 5.0 (Innomic) Fixed in 2.1.1866
  • Fix · CNA VibroLine VLE8 HD 5.0 (Innomic) Fixed in 2.1.1866
  • Fix · CNA VibroLine VLE1 HD 4.0 (Innomic) Fixed in 1.4.1074
  • Fix · CNA VibroLine VLE2 HD 4.0 (Innomic) Fixed in 1.4.1074
  • Fix · CNA VibroLine VLE4 HD 4.0 (Innomic) Fixed in 1.4.1074
  • Fix · CNA VibroLine VLE6 HD 4.0 (Innomic) Fixed in 1.4.1074
  • Fix · CNA VibroLine VLE8 HD 4.0 (Innomic) Fixed in 1.4.1074
  • Fix · CNA VibroLine VLX1 HD 4.0 (Innomic) Fixed in 1.5.1074
  • Fix · CNA VibroLine VLX2 HD 4.0 (Innomic) Fixed in 1.5.1074
  • Fix · CNA VibroLine VLX4 HD 4.0 (Innomic) Fixed in 1.5.1074
  • Fix · CNA VibroLine VLX6 HD 4.0 (Innomic) Fixed in 1.5.1074
  • Fix · CNA VibroLine VLX8 HD 4.0 (Innomic) Fixed in 1.5.1074

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Innomic AvibiaLine AVLE1 HD 5.0, AvibiaLine AVLE2 HD 5.0 and 28 more products — innomic.com/.well-known/csaf/white/2026/ids-2026-0001.html

    6 records Highest priority Priority MEDIUM 2 MEDIUM, 4 LOW

    Other records, highest priority first

    • TI-2022-26432 Multiple Innomic VibroLine VLX HD 5.0 and avibia AVLX weak password requirementsPriority MEDIUM 50
    • TI-2022-26426 Multiple Innomic VibroLine VLX and avibia AVLX allow unauthenticated access to device configurationPriority MEDIUM 40
    • TI-2022-26428 Multiple Innomic VibroLine VLX and avibia AVLX allow unauthenticated configuration preset change via HTTPPriority LOW 39
    Show all 6 records → Advisory →
  • Advisory ·

    Innomic AvibiaLine AVLE1 HD 5.0, AvibiaLine AVLE2 HD 5.0 and 28 more products — innomic.com/.well-known/csaf/white/2026/ids-2026-0001.json

    6 records Highest priority Priority MEDIUM 2 MEDIUM, 4 LOW

    Other records, highest priority first

    • TI-2022-26432 Multiple Innomic VibroLine VLX HD 5.0 and avibia AVLX weak password requirementsPriority MEDIUM 50
    • TI-2022-26426 Multiple Innomic VibroLine VLX and avibia AVLX allow unauthenticated access to device configurationPriority MEDIUM 40
    • TI-2022-26428 Multiple Innomic VibroLine VLX and avibia AVLX allow unauthenticated configuration preset change via HTTPPriority LOW 39
    Show all 6 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-50978
  2. 2026-10-03 Alias added: GHSA-vcc2-8qcw-j2m8

References

Advisory 2

  • TI-2022-26432 Multiple Innomic VibroLine VLX HD 5.0 and avibia AVLX weak password requirements CVSS 3.1CRITICAL 9.8
  • TI-2022-26426 Multiple Innomic VibroLine VLX and avibia AVLX allow unauthenticated access to device configuration CVSS 3.1HIGH 8.8
  • TI-2022-26428 Multiple Innomic VibroLine VLX and avibia AVLX allow unauthenticated configuration preset change via HTTP CVSS 3.1HIGH 7.5
  • TI-2022-26427 Innomic VibroLine Configurator and avibia Configurator allow unintended device reset via USB CVSS 3.1HIGH 7.7
  • TI-2022-26431 Multiple Innomic VibroLine VLX and avibia AVLX allow unauthenticated configuration preset change via CAN CVSS 3.1MEDIUM 6.5
  • TI-2022-26430 Multiple Innomic VibroLine VLX and avibia AVLX allow unauthenticated configuration preset change via Modbus (RS485) CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences