CVE-2022-1805

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-07-28 · updated 2026-06-17
Weakness: CWE-295

Description

When connecting to Amazon Workspaces, the SHA256 presented by AWS connection provisioner is not fully verified by Zero Clients. The issue could be exploited by an adversary that places a MITM (Man in the Middle) between a zero client and AWS session provisioner in the network. This issue is only applicable when connecting to an Amazon Workspace from a PCoIP Zero Client.

Affected products

Tera2 Zero Client: before 22.01.5; 22.04 — fixed in 22.01.5

How to fix

Upgrade to a fixed version: Tera2 Zero Client 22.01.5. Check the vendor advisory for mitigations.

References

https://support.hp.com/us-en/document/ish_6545906-6545930-16/hpsbhf03794
https://support.hp.com/us-en/document/ish_6545906-6545930-16/hpsbhf03794

Get alerted when CVE-2022-1805 or the next vulnerability affects your stack