VDE-2022-023 — TRUMPF TruTops prone to improper access control

Summary

During the installation of specific TRUMPF Windows applications, privileged local users with default usernames and passwords are created. An adversary could use these users to access and compromise the affected Windows systems and, under certain circumstances, other network resources.

Details

Impact
Privileged local users with default usernames and passwords can be used to access and compromise affected Windows PCs and possibly other network resources.

Remediation
Please contact your TRUMPF Service with the PR number 496330.

Vulnerabilities 1

Critical 9.8

CVE-2022-2052

TRUMPF TruTops default user accounts vulnerability

Multiple Trumpf Products in multiple versions use default privileged Windows users and passwords. An adversary may use these accounts to remotely gain full access to the system.

TRUMPF Werkzeugmaschinen SE + Co. KG TruTops Fab Job Order Interface TruTops Boost with option Graphic separation of cut parts

Oct 17, 2022

Revision history

2022-10-17 #1
initial revision

References

VDE-2022-023: TRUMPF TruTops prone to improper access control - HTML
https://certvde.com/de/advisories/VDE-2022-023/
CERT@VDE Security Advisories for
https://certvde.com/en/advisories/vendor/trumpf/