Mender blog

CVE-2022-32290 - Mender Client listening on all the interfaces

We recently discovered a vulnerability in the Mender Client versions 3.2.0, 3.2.1, and 3.2.2.

The client listens on a random, unprivileged TCP port and exposes an HTTP proxy to facilitate API calls from additional client components running on the device. However, it listens on all network interfaces instead of only the localhost interface. Therefore, any client on the same network can connect to this TCP port and send HTTP requests. The Mender Client will forward these requests to the Mender Server. Additionally, if mTLS is set up, the Mender Client will connect to the Mender Server using the device's client certificate, making it possible for the attacker to bypass mTLS authentication and send requests to the Mender Server without direct access to the client certificate and related private key. Accessing the HTTP proxy from the local network doesn't represent a direct threat, because it doesn't expose any device or server-specific data. However, it increases the attack surface and can be a potential vector to exploit other vulnerabilities both on the Client and the Server.

We patched the vulnerability in Mender 3.3.0. We suggest our users to upgrade to this version at their convenience. In the official public CVE registry, the issue's ID is CVE-2022-32290.

The security of the Mender product and our users is something we take very seriously. We will continue to look for, fix and responsibly disclose serious weaknesses in our product(s). If you have any questions or concerns, please get in touch with the Mender support if you have a support contract or email security@northern.tech.

Recent articles

Why cloud IoT solutions alone are not EU CRA compliant

Why cloud IoT solutions alone are not EU CRA compliant

Cloud IoT solutions often fall short in achieving compliance with the EU CRA. Learn more about the extensive requirements, and proper management solutions.
IoT Slam 2025: The impact of AI

IoT Slam 2025: The impact of AI

The recent IoT Slam 2025 conference outlined cutting-edge trends and technologies covering the entire spectrum of IoT across industries.
CVE-2025-49603 - Improper access control of device groups in Mender Server

CVE-2025-49603 - Improper access control of device groups in Mender Server

An ethical hacker on our HackerOne private bug bounty program recently discovered and disclosed access control issues with device groups in Mender Server.
View more articles

Learn why leading companies choose Mender

Discover how Mender empowers both you and your customers with secure and reliable over-the-air updates for IoT devices. Focus on your product, and benefit from specialized OTA expertise and best practices.

 
sales-pipeline_295756365