What’s Vulnerable › Vulnerabilities

CVE-2022-1368: Cognex 3D-A1000 Dimensioning System Missing Authentication for Critical Function

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-09-06 · updated 2026-06-17
• Weakness: CWE-306

Description

The Cognex 3D-A1000 Dimensioning System in firmware version 1.0.3 (3354) and prior is vulnerable to CWE-306: Missing Authentication for Critical Function, which allows unauthorized users to change the operator account password via webserver commands by monitoring web socket communications from an unauthenticated session. This could allow an attacker to escalate privileges to match those of the compromised account.

Affected products

• Cognex 3D-A1000 Dimensioning System: through 1.0.3\(3354\)

References

• https://www.cisa.gov/uscert/ics/advisories/icsa-22-249-03
• https://www.cisa.gov/uscert/ics/advisories/icsa-22-249-03

Get alerted when CVE-2022-1368 or the next vulnerability affects your stack