Critical · 9.8 CVE-2022-22512 EUVD-2022-27658GHSA-cm5w-jvqg-v9cr

VARTA: Multiple devices prone to hard-coded credentials

Published Mar 23, 2023 · Updated Feb 25, 2025 · Assigned by CERTVDE

Vendor: VARTA Storage Product: Element backup Product: Element S1 Product: Element S2 Product: Element S3 Product: Element S4 Product: One L/XL Product: Pulse (not pulse neo)

Description

Hard-coded credentials in Web-UI of multiple VARTA Storage products in multiple versions allows an unauthorized attacker to gain administrative access to the Web-UI via network.

Affected products

Vendor	Product	Affected	Fixed
VARTA Storage	Element backup	< F21000400	F21000400
VARTA Storage	Element S1	< 2e.3.8.0	2e.3.8.0
VARTA Storage	Element S2	< 2e.3.8.0	2e.3.8.0
VARTA Storage	Element S3	< 2e.3.8.0, < 2e.4.4.0	2e.3.8.0
VARTA Storage	Element S4	< D21010400	D21010400
VARTA Storage	One L/XL	< 2e.3.8.0	2e.3.8.0
VARTA Storage	Pulse (not pulse neo)	< C21010800	C21010800

Advisories 1

VDE-2022-061 VARTA: Multiple devices prone to hard-coded credentials CERT@VDE · Mar 15, 2023

References

https://cert.vde.com/en/advisories/VDE-2022-061/

CNA	v3.1	9.8
EUVD	v3.1	9.8