Is CVE-2022-1039 actively exploited?

No active exploitation of CVE-2022-1039 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2022-1039 be exploited remotely?

Yes. CVE-2022-1039 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2022-1039?

CVE-2022-1039 has a CVSS score of 9.8 (CRITICAL).

HOME VULNERABILITIESCVE-2022-1039

CRITICAL

CVE-2022-1039

CWE-521Published: April 20, 2022· Updated: Jun 17, 2026

9.8

CVSS v3.1

Official Description

The weak password on the web user interface can be exploited via HTTP or HTTPS. Once such access has been obtained, the other passwords can be changed. The weak password on Linux accounts can be accessed via SSH or Telnet, the former of which is by default enabled on trusted interfaces. While the SSH service does not support root login, a user logging in using either of the other Linux accounts may elevate to root access using the su command if they have access to the associated password.

NVD Source

Technical Analysis

CVE-2022-1039 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 9.8.