IDS VibroLine Security Advisory: Multiple CVEs for Unauthorized Access and Config Switch

Key Information Vulnerability Overview ID: IDS-2026-0001 Title: Unauthorized access affects VibroLine devices Publisher: IDS Innomic Schwingungsmesstechnik GmbH Initial Release Date: 2026-02-02 Current Release Date: 2026-02-02 CVSS v3.1 Base Score: 9.8 Severity: High Vulnerability Details CVE-2022-50975: Unauthorized Access To Device Configuration - CWE: CWE-346 (Origin Validation Error) - Impact: Ethernet and USB connections are not properly isolated, allowing an attacker to configure and reset the device when configuration is enabled over Ethernet and at least one legitimate connection exists. - Mitigation: Update firmware of VibroLine VLX HD 5.0 devices to version 2.1.1866 or higher. CVE-2022-50976: Unintended Device Reset - CWE: CWE-1288 (Improper Validation of Consistency within Input) - Impact: Using an invalid reset file to reset the device password causes a complete device reset if the device is connected via USB. - Mitigation: Update VibroLine Configurator to version 5.1.2730 or higher. CVE-2022-50977: Unauthorized Configuration Switch Via HTTP - CWE: CWE-306 (Missing Authentication for Critical Function) - Impact: The configuration preset switching function via HTTP is accessible without authentication, allowing attackers to disrupt normal operations. - Mitigation: Isolate the network and restrict access to trusted devices only. CVE-2022-50978: Unauthorized Configuration Switch Via Modbus (TCP) - CWE: CWE-306 (Missing Authentication for Critical Function) - Impact: The configuration preset switching function via Modbus (TCP) is accessible without authentication. - Mitigation: Isolate the network and restrict access to trusted devices only. CVE-2022-50979: Unauthorized Configuration Switch Via Modbus (RS485) - CWE: CWE-306 (Missing Authentication for Critical Function) - Impact: The configuration preset switching function via Modbus (RS485) is accessible without authentication. - Mitigation: Restrict access to the RS485 bus to trusted devices only. CVE-2022-50980: Unauthorized Configuration Switch Via CAN - CWE: CWE-306 (Missing Authentication for Critical Function) - Impact: The configuration preset switching function via CAN is accessible without authentication. - Mitigation: Restrict access to the CAN bus to trusted devices only. CVE-2022-50981: No Password By Default - CWE: CWE-521 (Weak Password Requirements) - Impact: Devices come with no default password, and there is no enforcement to set a password during initial setup. - Mitigation: Set a device password during first use. References CSAF JSON HTML Version BSI Version

Goal Reached Thanks to every supporter — we hit 100%!

IDS VibroLine Security Advisory: Multiple CVEs for Unauthorized Access and Config Switch