CVE-2022-22512: Varta Element Backup Firmware

Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days.

Hard-coded credentials in Web-UI of multiple VARTA Storage products in multiple versions allows an unauthorized attacker to gain administrative access to the Web-UI via network.

Affected products

• Varta Element Backup Firmware: before f21000400 (fixed in f21000400)
• Varta Element s1 Firmware: before 2e.3.8.0 (fixed in 2e.3.8.0)
• Varta Element s2 Firmware: before 2e.3.8.0 (fixed in 2e.3.8.0)
• Varta Element s3 Firmware: before 2e.3.8.0 (fixed in 2e.3.8.0); from 2e.4.0.0, before 2e.4.4.0 (fixed in 2e.4.4.0)
• Varta Element s4 Firmware: before d21010400 (fixed in d21010400)
• Varta One L Firmware: before 2e.3.8.0 (fixed in 2e.3.8.0)
• Varta One Xl Firmware: before 2e.3.8.0 (fixed in 2e.3.8.0)
• Varta Pulse Firmware: before c21010800 (fixed in c21010800)

Published 2023-03-23. Last modified 2026-06-17.