What’s Vulnerable › Vulnerabilities

CVE-2022-2302: LENZE: Missing password verification in authorisation procedure

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-07-11 · updated 2026-06-17
• Weakness: CWE-304

Description

Multiple Lenze products of the cabinet series skip the password verification upon second login. After a user has been logged on to the device once, a remote attacker can get full access without knowledge of the password.

Affected products

• Lenze C520 Firmware: from 1.07.00.2757 before 01.08.01.3021 — fixed in 01.08.01.3021
• Lenze C550 Firmware: from 1.07.00.2757 before 01.08.01.3021 — fixed in 01.08.01.3021
• Lenze C750 Firmware: from 1.07.00.2757 before 01.08.01.3021 — fixed in 01.08.01.3021

How to fix

Upgrade to a fixed version: Lenze C520 Firmware 01.08.01.3021; Lenze C550 Firmware 01.08.01.3021; Lenze C750 Firmware 01.08.01.3021. Check the vendor advisory for mitigations.

References

• https://cert.vde.com/en/advisories/VDE-2022-030/
• https://cert.vde.com/en/advisories/VDE-2022-030/

Get alerted when CVE-2022-2302 or the next vulnerability affects your stack