Mender blog

CVE-2022-32290 - Mender Client listening on all the interfaces

We recently discovered a vulnerability in the Mender Client versions 3.2.0, 3.2.1, and 3.2.2.

The client listens on a random, unprivileged TCP port and exposes an HTTP proxy to facilitate API calls from additional client components running on the device. However, it listens on all network interfaces instead of only the localhost interface. Therefore, any client on the same network can connect to this TCP port and send HTTP requests. The Mender Client will forward these requests to the Mender Server. Additionally, if mTLS is set up, the Mender Client will connect to the Mender Server using the device's client certificate, making it possible for the attacker to bypass mTLS authentication and send requests to the Mender Server without direct access to the client certificate and related private key. Accessing the HTTP proxy from the local network doesn't represent a direct threat, because it doesn't expose any device or server-specific data. However, it increases the attack surface and can be a potential vector to exploit other vulnerabilities both on the Client and the Server.

We patched the vulnerability in Mender 3.3.0. We suggest our users to upgrade to this version at their convenience. In the official public CVE registry, the issue's ID is CVE-2022-32290.

The security of the Mender product and our users is something we take very seriously. We will continue to look for, fix and responsibly disclose serious weaknesses in our product(s). If you have any questions or concerns, please get in touch with the Mender support if you have a support contract or email security@northern.tech.

Recent articles

IoT growth is outpacing readiness – Here’s what the data says

IoT growth is outpacing readiness – Here’s what the data says

Learn more about the key takeaways from Northern.tech's recent 2025 State of Industrial IoT Device Lifecycle Management report.
Does EU CRA compliance require advanced OTA update capabilities?

Does EU CRA compliance require advanced OTA update capabilities?

Learn about the requirements of the EU CRA. Outlining the importance of robust OTA update capabilities as a cornerstone of CRA compliance.
Sustainable devices, smart innovation: How OTA updates can contribute to cutting costs and carbon

Sustainable devices, smart innovation: How OTA updates can contribute to cutting costs and carbon

Discover how OTA updates help companies like Kuva Systems and Beegy reduce emissions, cut costs, and build smarter, more sustainable IoT systems.
View more articles

Learn why leading companies choose Mender

Discover how Mender empowers both you and your customers with secure and reliable over-the-air updates for IoT devices. Focus on your product, and benefit from specialized OTA expertise and best practices.

 
sales-pipeline_295756365