CVE-2022-1368

criticalpriority · track · 39OT risk · elevatedEPSS 0.009 · 61 %ileEURUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.95% (61st) EPSS

CVSS 9.8 · critical

Is it mine?

5 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_ot

EPSS · scored 2026-10-27

The Cognex 3D-A1000 Dimensioning System in firmware version 1.0.3 (3354) and prior is vulnerable to CWE-306: Missing Authentication for Critical Function, which allows unauthorized users to change the operator account password via webserver commands by monitoring web socket communications from an unauthenticated session. This could allow an attacker to escalate privileges to match those of the compromised account.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

No vendor fix yet; a mitigation is available.

MitigationCognex 3D-A1000 Dimensioning Systemcisa_csaf_ot
Cognex has reportedly fixed these issues in release 1.2 PR2. For more information, users should contact Cognex support (login required).
https://www.cognex.com/en/support

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 5.9

v3.09.8criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · CISA US

v3.19.8criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · ics-cert@hq.dhs.gov USexploitability 3.9 · impact 5.9

v3.19criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-306USCWE-306USCWE-306US

affected products (5)

Products and version ranges known to be affected.

3D-A1000 Dimensioning System - Cognex 3D-A1000 Dimensioning System: Firmware Version: 1.0.3 (3354) and priorall versionscisa_csaf_otUS
Cognex Cognex 3D-A1000 Dimensioning System≤ 1.0.3 (3354)cisa_csaf_otUS
Cognex 3D-A1000 Dimensioning System≤ all ≤1.0.3 (3354)enisa_euvdEU
Cognex 3D-A1000 Dimensioning System≤ 1.2 PR2fstec_bduRU
cognex 3d-a1000 dimensioning system firmware≤ 1.0.3\(3354\)nvdUScpe:2.3:o:cognex:3d-a1000_dimensioning_system_firmware:*:*:*:*:*:*:*:*

advisories (1)

Vendor and ecosystem advisories describing this.

ICSA-22-249-03Cognex 3D-A1000 Dimensioning System2022-09-06icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities could result in unauthorized password changes, escalation of privileges, falsifying of password logs, and bypassing of web access controls.

also known as (5)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cisa_csaf_ot nvd NVD CVE.org MITRE

published 2022-09-06modified 2026-06-17

references (8)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan