PatchTheCVECVE-2022-1368: The Cognex 3D-A1000 Dimensioning System in firmware version 1.0.3 (3354) and prior is vulnerable to CWE-306: M
CVE-2022-1368 is a critical-severity flaw (CVSS 9.8) affecting 3d-a1000 dimensioning system firmware. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The Cognex 3D-A1000 Dimensioning System in firmware version 1.0.3 (3354) and prior is vulnerable to CWE-306: Missing Authentication for Critical Function, which allows unauthorized users to change the operator account password via webserver commands by monitoring web socket communications from an unauthenticated session. This could allow an attacker to escalate privileges to match those of the compromised account.
Why this priority
- Critical severity
- Remotely exploitable, no login, no user action
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 9.8 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.9% (top 39%) |
| CISA exploited list | No |
| Weakness | CWE-306 |
| Published | 2022-09-06 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2022-1368?
3d-a1000 dimensioning system firmware: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2022-1368 being exploited?
CVE-2022-1368 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2022-1368 affect?
CVE-2022-1368 affects 3d-a1000 dimensioning system firmware. Severity is critical (CVSS 9.8). The Cognex 3D-A1000 Dimensioning System in firmware version 1.0.3 (3354) and prior is vulnerable to CWE-306: Missing Authentication for Critical Function, which allows unauthorized users to change the operator account password via webserver
How urgent is CVE-2022-1368?
Priority 55/100. Critical severity; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2022-1525 CRITICAL 9.1 MITIGATE The Cognex 3D-A1000 Dimensioning System in firmware version 1.0.3 (3354) and prior is vulnerable to CWE-602: C
- CVE-2022-1522 MEDIUM 5.3 MITIGATE The Cognex 3D-A1000 Dimensioning System in firmware version 1.0.3 (3354) and prior is vulnerable to CWE-117: I