CVE-2022-45546
📋 TL;DR
CVE-2022-45546 is an information disclosure vulnerability in ScreenCheck BadgeMaker 2.6.2.0 that allows internal attackers to capture authentication credentials via network sniffing. The vulnerability affects organizations using this specific version of the badge creation software. Attackers can intercept unencrypted authentication data transmitted over the network.
💻 Affected Systems
- ScreenCheck BadgeMaker
📦 What is this software?
Badgemaker by Screencheck
⚠️ Risk & Real-World Impact
Worst Case
Attackers obtain administrative credentials, gain full control of the BadgeMaker system, and potentially pivot to other systems using the same credentials.
Likely Case
Internal attackers capture user credentials, access sensitive badge data, and create unauthorized badges or modify existing ones.
If Mitigated
With proper network segmentation and monitoring, credential theft is detected before exploitation, limiting impact to isolated systems.
🎯 Exploit Status
Exploitation requires network access and basic sniffing tools like Wireshark. No authentication needed beyond network positioning.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.6.3.0 or later
Vendor Advisory: https://lgnas.gitbook.io/cve-2022-45546/
Restart Required: Yes
Instructions:
1. Download latest version from vendor. 2. Backup current configuration. 3. Install update. 4. Restart BadgeMaker service. 5. Verify encryption is enabled.
🔧 Temporary Workarounds
Network Segmentation
allIsolate BadgeMaker system on separate VLAN to limit sniffing exposure
Encryption Enforcement
allConfigure network devices to require encrypted connections to BadgeMaker system
🧯 If You Can't Patch
- Implement strict network access controls to limit who can communicate with the BadgeMaker system
- Deploy network monitoring to detect sniffing attempts and credential interception
🔍 How to Verify
Check if Vulnerable:
Check BadgeMaker version in Help > About menu. If version is 2.6.2.0, system is vulnerable.Check Version:
Check Help > About in BadgeMaker application interfaceVerify Fix Applied:
Verify version is 2.6.3.0 or later and test authentication traffic with Wireshark to confirm encryption.📡 Detection & Monitoring
Log Indicators:
- Multiple failed authentication attempts from unusual IPs
- Authentication logs showing successful logins from unexpected locations
Network Indicators:
- Unencrypted authentication traffic to BadgeMaker port
- ARP spoofing or promiscuous mode detection on BadgeMaker network
SIEM Query:
source="badgemaker.log" AND (event_type="authentication" AND NOT protocol="TLS")