CVE-2022-38121 affects UPSMON PRO, where its configuration file stores user passwords in plaintext within a publicly accessible user directory. This medium-severity vulnerability (CVSS 6.5) allows a remote attacker with general user privileges to easily access all user and administrator credentials, leading to a high impact on confidentiality. While not actively exploited in the wild or on the CISA KEV catalog, a Metasploit module exists for credential harvesting, indicating readily available exploit code. Despite this, community discussion and media coverage remain low.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
2.57CPE matchmatch criteria | cpe:2.3:a:upspowercom:upsmon_pro:2.57:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.