CVE-2022-38125
FTP Agent forwards traffic on inactive ports to LinkManager
Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Secomea SiteManager (FTP Agent modules) allows Exploiting Trust in Client.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
FTP Agent forwards traffic on inactive ports to LinkManager
Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Secomea SiteManager (FTP Agent modules) allows Exploiting Trust in Client.
- Record
CVE-2022-38125- CVSS 3.1
- 2.9 Low
CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N - CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-923, CWE-923
- Updated
- 2026-11-02
EUVDEUVD-2022-40727
Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Secomea SiteManager (FTP Agent modules) allows Exploiting Trust in Client.
- Record
EUVD-2022-40727- CVSS 3.1
- 2.9 Low
CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-99j2-jmgm-p5x6
Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Secomea...
Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Secomea SiteManager (FTP Agent modules) allows Exploiting Trust in Client.
- Record
GHSA-99j2-jmgm-p5x6- CVSS 3.1
- 2.9 Low
CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N - Weakness
- CWE-923
- Updated
- 2026-11-02
NVD
Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Secomea SiteManager (FTP Agent modules) allows Exploiting Trust in Client.
- Record
CVE-2022-38125- CVSS 3.1
- 2.9 Low
CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N - CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-923
- Updated
- 2026-11-02
Affected products
- secomea sitemanager
- secomea sitemanager 1129 firmware
- secomea sitemanager 1139 firmware
- secomea sitemanager 1149 firmware
- secomea sitemanager 1529 firmware
- secomea sitemanager 1539 firmware
- secomea sitemanager 1549 firmware
- secomea sitemanager 3329 firmware
- secomea sitemanager 3339 firmware
- secomea sitemanager 3349 firmware
- secomea sitemanager 3529 firmware
- secomea sitemanager 3539 firmware
Show 1 moreShow less
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-38125 is a low vulnerability (CVSS 2.9) in Secomea Sitemanager, published April 19, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.16%, the 4th percentile. No source names a fixed version.