cve/2022/CVE-2022-2336.md

### [CVE-2022-2336](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2336)
![](https://img.shields.io/static/v1?label=Product&message=Secure%20Integration%20Server&color=blue)
![](https://img.shields.io/static/v1?label=Product&message=edgeAggregator&color=blue)
![](https://img.shields.io/static/v1?label=Product&message=edgeConnector%20840D&color=blue)
![](https://img.shields.io/static/v1?label=Product&message=edgeConnector%20Modbus&color=blue)
![](https://img.shields.io/static/v1?label=Product&message=edgeConnector%20Siemens&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3D%20V1.22%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Version&message=%3D%20V3.10%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-287%3A%20Improper%20Authentication&color=brighgreen)

### Description

Softing Secure Integration Server, edgeConnector, and edgeAggregator software ships with the default administrator credentials as `admin` and password as `admin`. This allows Softing to log in to the server directly to perform administrative functions. Upon installation or upon first login, the application does not ask the user to change the `admin` password. There is no warning or prompt to ask the user to change the default password, and to change the password, many steps are required.

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/ARPSyndicate/cvemon
- https://github.com/rdomanski/Exploits_and_Advisories