CVE-2022-25246
📋 TL;DR
This vulnerability allows remote authenticated attackers to take full control of affected systems through hard-coded UltraVNC credentials in Axeda products. All versions of Axeda agent and Axeda Desktop Server for Windows are affected. Attackers can execute arbitrary code with system privileges.
💻 Affected Systems
- Axeda agent
- Axeda Desktop Server for Windows
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the host operating system, allowing attackers to install malware, steal data, pivot to other systems, and maintain persistent access.
Likely Case
Remote code execution leading to data exfiltration, ransomware deployment, or system disruption in industrial environments.
If Mitigated
Limited impact if systems are isolated, have strict network segmentation, and VNC access is blocked at firewalls.
🎯 Exploit Status
Exploitation requires authentication but uses known hard-coded credentials. Attack tools for VNC exploitation are widely available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not version-specific - requires configuration changes
Vendor Advisory: https://www.ptc.com/en/support/article/CS363561
Restart Required: Yes
Instructions:
1. Change UltraVNC password from default hard-coded credentials. 2. Restart Axeda services. 3. Ensure VNC is not exposed to untrusted networks. 4. Consider disabling VNC if not required.
🔧 Temporary Workarounds
Block VNC network access
windowsUse firewall rules to block UltraVNC port (default 5900) from untrusted networks
netsh advfirewall firewall add rule name="Block VNC" dir=in action=block protocol=TCP localport=5900
Disable UltraVNC service
windowsStop and disable the UltraVNC service if remote access is not required
sc stop uvnc_service
sc config uvnc_service start= disabled
🧯 If You Can't Patch
- Implement strict network segmentation to isolate affected systems
- Deploy host-based firewalls to restrict VNC access to authorized IPs only
🔍 How to Verify
Check if Vulnerable:
Check if UltraVNC is running with default credentials by attempting VNC connection using known hard-coded credentialsCheck Version:
Not applicable - all versions affectedVerify Fix Applied:
Verify VNC connection fails with old credentials and succeeds only with new credentials📡 Detection & Monitoring
Log Indicators:
- Failed VNC authentication attempts
- Successful VNC connections from unusual IPs
- Process creation from VNC service
Network Indicators:
- VNC traffic on port 5900 from unexpected sources
- Multiple VNC connection attempts
SIEM Query:
source="vnc.log" AND (event="authentication failed" OR event="connection established")