Device42 is a configuration management database (CMDB) and IT asset-discovery platform deployed across enterprise environments to inventory and track infrastructure; its vulnerability profile reflects the sensitive scope of that role. The vendor's disclosures skew strongly toward critical-severity outcomes and cluster around command-injection vulnerabilities (argument and OS command injection), improper authorization controls, and hard-coded credentials in its CMDB and remote-collector products—weaknesses that compound the risk when a discovery tool gains administrative access across customer networks. Defenders should treat Device42 advisories as high-priority given the vendor's deep visibility into IT infrastructure and the severity tendency of its flaws; live exploitation activity and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Device42 over time
Signals from CVEs in this vendor scope (6 CVEs).
6 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2021-41315HIGH The Device42 Remote Collector before 17.05.01 does not sanitize user input in its SNMP Connectivity utility. This allows an authenticated attacker (with access to the console appli | Sep 17, 2021 | 8.8 | 27 | NO | NO |
CVE-2022-1401HIGH Improper Access Control vulnerability in the /Exago/WrImageResource.adx route as used in Device42 Asset Management Appliance allows an unauthenticated attacker to read sensitive se | Aug 17, 2022 | 7.5 | 26 | NO | NO |
CVE-2021-41316HIGH The Device42 Main Appliance before 17.05.01 does not sanitize user input in its Nmap Discovery utility. An attacker (with permissions to add or edit jobs run by this utility) can i | Sep 17, 2021 | 8.1 | 25 | NO | NO |
CVE-2022-1400CRITICAL Use of Hard-coded Cryptographic Key vulnerability in the WebReportsApi.dll of Exago Web Reports, as used in the Device42 Asset Management Appliance, allows an attacker to leak sess | Aug 17, 2022 | 9.8 | 24 | NO | NO |
CVE-2022-1410HIGH OS Command Injection vulnerability in the db_optimize component of Device42 Asset Management Appliance allows an authenticated attacker to execute remote code on the device. This i | Aug 17, 2022 | 8.8 | 22 | NO | NO |
CVE-2022-1399CRITICAL An Argument Injection or Modification vulnerability in the "Change Secret" username field as used in the Discovery component of Device42 CMDB allows a local attacker to run arbitra | Aug 17, 2022 | 9.1 | 22 | NO | NO |
Signals from CVEs in this vendor scope (6 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Device42.
Media articles that mention a CVE ID that affects a product developed by Device42 — matched by CVE ID, not by vendor name.