CVE-2022-50975
📋 TL;DR
This vulnerability allows an unauthenticated remote attacker to hijack existing user sessions and gain full administrative access to affected devices. It affects systems with ethernet configuration enabled, potentially exposing them to complete compromise. The attack requires no authentication and can be executed remotely.
💻 Affected Systems
- Innomic devices with ethernet configuration capability
⚠️ Risk & Real-World Impact
Worst Case
Complete device takeover leading to data theft, system manipulation, lateral movement within network, and persistent backdoor installation.
Likely Case
Unauthorized administrative access allowing configuration changes, data access, and potential disruption of device functionality.
If Mitigated
Limited impact with proper network segmentation, disabled ethernet configuration, and session management controls in place.
🎯 Exploit Status
Attack requires knowledge of existing session IDs and ethernet configuration enabled
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified in provided references
Vendor Advisory: https://www.innomic.com/.well-known/csaf/white/2026/ids-2026-0001.html
Restart Required: Yes
Instructions:
1. Check vendor advisory for specific patch version. 2. Download firmware update from Innomic. 3. Apply update following vendor instructions. 4. Restart device to activate patch.
🔧 Temporary Workarounds
Disable Ethernet Configuration
allTurn off ethernet configuration feature to prevent exploitation
Configuration command depends on specific device model
Network Segmentation
allIsolate affected devices from untrusted networks
Implement firewall rules to restrict access to device management interfaces
🧯 If You Can't Patch
- Disable ethernet configuration feature immediately
- Implement strict network access controls and monitor for unauthorized access attempts
🔍 How to Verify
Check if Vulnerable:
Check if ethernet configuration is enabled and review session management implementationCheck Version:
Device-specific command (check vendor documentation)Verify Fix Applied:
Verify firmware version matches patched version from vendor advisory📡 Detection & Monitoring
Log Indicators:
- Unauthorized session access attempts
- Multiple administrative logins from unusual locations
- Configuration changes from unexpected sources
Network Indicators:
- Unusual traffic to device management ports
- Session hijacking patterns in network traffic
SIEM Query:
source_ip NOT IN authorized_ips AND destination_port IN [management_ports] AND action='session_access'