CVE-2022-4779: authentication bypass in elvexys StreamX using StreamView HTML component with public web server feature

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-12-29 · updated 2026-06-17
Weakness: CWE-22

Description

StreamX applications from versions 6.02.01 to 6.04.34 are affected by a logic bug that allows to bypass the implemented authentication scheme. StreamX applications using StreamView HTML component with the public web server feature activated are affected.

Affected products

elvexys StreamX: from 6.02.01 through 6.04.34

References

https://elvexys.com/products/xpg-gateway-rtu-protocol-converter/streamx-release-notes/
https://elvexys.com/products/xpg-gateway-rtu-protocol-converter/streamx-release-notes/

Get alerted when CVE-2022-4779 or the next vulnerability affects your stack