CVE-2022-2052

criticalpriority · track · 0EPSS 0.007 · 55 %ileDEEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.75% (55th) EPSS

CVSS 9.8 · critical

Is it mine?

17 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · nvd · trumpf_psirt

EPSS · scored 2026-10-26

Multiple Trumpf Products in multiple versions use default privileged Windows users and passwords. An adversary may use these accounts to remotely gain full access to the system.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

Fixedtrumpf_psirt
Please contact your TRUMPF Service with the PR number 496330.

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · info@cert.vde.comexploitability 3.9 · impact 5.9

v3.19criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · TRUMPF PSIRT

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-284USCWE-284US

affected products (17)

Products and version ranges known to be affected.

TRUMPF Werkzeugmaschinen SE + Co. KG Job Order Interface≤ All Versionsenisa_euvdEU
TRUMPF Werkzeugmaschinen SE + Co. KG Oseon≤ unspecified ≤1.6enisa_euvdEU
TRUMPF Werkzeugmaschinen SE + Co. KG TruTops Boost with option Graphic separation of cut parts≤ All Versionsenisa_euvdEU
TRUMPF Werkzeugmaschinen SE + Co. KG TruTops Boost with option Inventory of sheets and remainder sheets≤ All Versionsenisa_euvdEU
TRUMPF Werkzeugmaschinen SE + Co. KG TruTops Fab≤ All Versionsenisa_euvdEU
TRUMPF Werkzeugmaschinen SE + Co. KG TruTops Monitor≤ All Versionsenisa_euvdEU
trumpf job order interfaceall versionsnvdUScpe:2.3:a:trumpf:job_order_interface:*:*:*:*:*:*:*:*
trumpf oseon≤ 1.6nvdUScpe:2.3:a:trumpf:oseon:*:*:*:*:*:*:*:*
trumpf trutops boostall versionsnvdUScpe:2.3:a:trumpf:trutops_boost:*:*:*:*:*:*:*:*
trumpf trutops faball versionsnvdUScpe:2.3:a:trumpf:trutops_fab:*:*:*:*:*:*:*:*
trumpf trutops monitorall versionsnvdUScpe:2.3:a:trumpf:trutops_monitor:*:*:*:*:*:*:*:*
Firmware <=1.6 installed on Oseonall versionstrumpf_psirtDE
Firmware vers:all/* installed on Job Order Interfaceall versionstrumpf_psirtDE
Firmware vers:all/* installed on TruTops Boost with option Graphic separation of cut partsall versionstrumpf_psirtDE
Firmware vers:all/* installed on TruTops Boost with option Inventory of sheets and remainder sheetsall versionstrumpf_psirtDE
Firmware vers:all/* installed on TruTops Faball versionstrumpf_psirtDE
Firmware vers:all/* installed on TruTops Monitorall versionstrumpf_psirtDE

advisories (1)

Vendor and ecosystem advisories describing this.

VDE-2022-023TRUMPF TruTops prone to improper access control2022-10-17csaf · trumpf_psirtDE
During the installation of specific TRUMPF Windows applications, privileged local users with default usernames and passwords are created. An adversary could use these users to access and compromise the affected Windows systems and, under certain circumstances, other network resources.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd nvd trumpf_psirt NVD CVE.org MITRE

published 2022-10-17modified 2026-06-17

references (5)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan