CVE-2022-1399: DEVICE42 Cmdb

Critical severity, CVSS 9.1. EPSS: 0.9% chance of exploitation in the next 30 days.

An Argument Injection or Modification vulnerability in the "Change Secret" username field as used in the Discovery component of Device42 CMDB allows a local attacker to run arbitrary code on the appliance with root privileges. This issue affects: Device42 CMDB version 18.01.00 and prior versions.

Affected products

• DEVICE42 Cmdb: before 18.01.00 (fixed in 18.01.00)

Published 2022-08-17. Last modified 2026-06-17.