CVE-2022-2474

CVE-2022-2474 describes a critical authentication bypass vulnerability in Haas Controller version 100.20.000.1110, specifically within its "Ethernet Q Commands" service. This flaw allows any user on the same network segment, including remote attackers, to access the service without authentication. With a CVSS score of 8.0 (High), the vulnerability presents a significant risk, enabling unauthorized users to write malicious macros to the device, leading to potential compromise of confidentiality, integrity, and availability. While no active exploitation, public exploit code, or significant community discussion has been observed, the absence of authentication makes this a straightforward attack for an adversary with network access.