CVE-2022-37144: Plextrac

High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days.

The PlexTrac platform prior to API version 1.17.0 does not restrict excessive MFA TOTP submission attempts. An unauthenticated remote attacker in possession of a valid username and password can bruteforce their way past MFA protections to login as the targeted user.

Affected products

• Plextrac Plextrac: before 1.17.0 (fixed in 1.17.0)

Published 2022-09-08. Last modified 2026-07-09.