CVE-2022-43326

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-11-29 · updated 2026-06-17
Weakness: CWE-639

Description

An Insecure Direct Object Reference (IDOR) vulnerability in the password reset function of Telos Alliance Omnia MPX Node 1.0.0-1.4.[*] allows attackers to arbitrarily change user and Administrator account passwords.

Affected products

Telosalliance Omnia Mpx Node Firmware: from 1.0.0 before 1.5.0 — fixed in 1.5.0

How to fix

Upgrade to a fixed version: Telosalliance Omnia Mpx Node Firmware 1.5.0. Check the vendor advisory for mitigations.

References

https://cyber-guy.gitbook.io/cyber-guys-blog/pocs/cve-2022-43326
https://cyber-guy.gitbook.io/cyber-guys-blog/pocs/cve-2022-43326

Get alerted when CVE-2022-43326 or the next vulnerability affects your stack