CVE-2022-50977CWE-306

Multiple Innomic VibroLine VLX and avibia AVLX allow unauthenticated configuration preset change via HTTP

High · published February 2, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
41.7
In the wild
Unconfirmed
What it is

⚡ An unauthenticated remote attacker can switch configuration presets faster than you can say "uh-oh!" This is a high-severity vulnerability that can disrupt operations! Think of it like someone sneakily changing settings on a smart thermostat. If they can flick between temperatures without permission, they could leave you sweating or shivering at the worst times! If an attacker exploits this vulnerability, they can wreak havoc by rapidly switching configurations, which may lead to system instability and operational disruptions. This could cause critical services to go offline or behave unpredictably, putting your operations at risk and leaving your users frustrated.

Put simply

Think of it like someone sneakily changing settings on a smart thermostat. If they can flick between temperatures without permission, they could leave you sweating or shivering at the worst times! CVE-2022-50977 allows an unauthenticated remote attacker to change configuration presets via HTTP requests. This means they can manipulate system settings without needing any credentials, opening the door to potential chaos.

What to do

If an attacker exploits this vulnerability, they can wreak havoc by rapidly switching configurations, which may lead to system instability and operational disruptions. This could cause critical services to go offline or behave unpredictably, putting your operations at risk and leaving your users frustrated. To address this vulnerability, immediately implement authentication checks for configuration changes and restrict access to sensitive endpoints. Ensure that only authorized users can modify settings, and consider reviewing your logging to monitor any unauthorized access attempts. You got this! Secure your system and keep those configurations in check! 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00497 · 41.7th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-02-02T14:08Z
EPSS history
Timeline
  • 02 FEB 14:08Z
    Multiple Innomic VibroLine VLX and avibia AVLX allow unauthenticated configuration preset change via HTTP
    cvelistv5