Is CVE-2022-34151 actively exploited?

Yes. CVE-2022-34151 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means exploitation in the wild has been confirmed.

Can CVE-2022-34151 be exploited remotely?

The attack vector of CVE-2022-34151 has not been classified yet.

What is the CVSS score of CVE-2022-34151?

CVE-2022-34151 has not received a CVSS score yet.

HOME VULNERABILITIESCVE-2022-34151

UNKNOWNCISA KEVIN THE WILD

CVE-2022-34151

Published: April 11, 2026

Official Description

Use of hard-coded credentials vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controller NX1 series all models V1.48 and earlier, Automation software 'Sysmac Studio' all models V1.49 and earlier, and Programmable Terminal (PT) NA series NA5-15W/NA5-12W/NA5-9W/NA5-7W models Runtime V1.15 and earlier, which may allow a remote attacker who successfully obtained the user credentials by analyzing the affected product to access the controller.

NVD Source

Technical Analysis

CVE-2022-34151 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CISA has added CVE-2022-34151 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.