Mender blog

CVE-2022-29555 & CVE-2022-29556 - vulnerabilities in iot-manager and deviceconnect

We recently discovered two vulnerabilities in Mender, thanks to the security researchers April Chaire, Jeff Hofmann, Joey Perme, Nathaniel Singer and Matteo Tarbet, and we have now fixed them.

The deviceconnect microservice in Mender before version 3.2.2 allows Cross-Origin WebSocket Hijacking. The vulnerability is present in the following versions of the product: 2.6.x, 2.7.x, 3.0.x, 3.1.x, 3.2.0, 3.2.1. The vulnerability was patched in Mender 3.2.2. In the official public CVE registry, the issue's ID is CVE-2022-29555.

The iot-manager microservice Mender before version 3.2.2 allows SSRF because the Azure IoT Hub integration provides several SSRF primitives that can execute cross-tenant actions via internal API endpoints. The vulnerability is present in the following versions of the product: 3.2.0, 3.2.1. The vulnerability was patched in Mender 3.2.2. In the official public CVE registry, the issue's ID is CVE-2022-29556.

The security of the Mender product and our users is something we take very seriously. We will continue to look for, fix and responsibly disclose serious weaknesses in our product(s). If you have any questions or concerns, please get in touch with the Mender support if you have a support contract or email security@northern.tech.

Recent articles

The reach of AI: Digital, edge, physical, and beyond

The reach of AI: Digital, edge, physical, and beyond

The recent NVIDIA GTC 2025 conference outlined AI developments. Learn more about simulations, data generation, and the importance of OTA updates in growing AI capabilities.
Robust OTA updates with A/B Partitions for Linux devices

Robust OTA updates with A/B Partitions for Linux devices

Discover insights from Embedded World 2025 on A/B partitions for secure OTA updates, reducing fragmentation, and streamlining embedded system firmware updates.
The power of over-the-air (OTA) updates in patch management

The power of over-the-air (OTA) updates in patch management

Learn about the power of over-the-air (OTA) updates in patch management. Outlining the importance of robust capabilities in enhancing CRA compliance.
View more articles

Learn why leading companies choose Mender

Discover how Mender empowers both you and your customers with secure and reliable over-the-air updates for IoT devices. Focus on your product, and benefit from specialized OTA expertise and best practices.

 
sales-pipeline_295756365