CVE-2022-2474: Haascnc Haas Controller Firmware

High severity, CVSS 8.0. EPSS: 0.8% chance of exploitation in the next 30 days.

Authentication is currently unsupported in Haas Controller version 100.20.000.1110 when using the “Ethernet Q Commands” service, which allows any user on the same network segment as the controller (even while connected remotely) to access the service and write unauthorized macros to the device.

Affected products

• Haascnc Haas Controller Firmware: version 100.20.000.1110 only

Published 2022-10-28. Last modified 2026-06-17.