CVE-2022-4332 Sprecher: Vulnerable firmware verification

What is CVE-2022-4332?

CVE-2022-4332 is a medium-severity vulnerability in Sprecher Automation SPRECON-E-C/P/T3 CPU PU244x, published on 1 Jun 2023. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In Sprecher Automation SPRECON-E-C/P/T3 CPU in variant PU244x a vulnerable firmware verification has been identified. Through physical access and hardware manipulation, an attacker might be able to bypass hardware-based code verification and thus inject and execute arbitrary code and gain full access of the device.

Weakness: CWE-20

Which versions are affected by CVE-2022-4332?

It affects 6 products.

Products include Sprecher-Automation Sprecon-E-C Firmware, Sprecher-Automation Sprecon-E-P Dl6-1 Firmware, Sprecher-Automation Sprecon-E-P Dq6-1 Firmware, Sprecher-Automation Sprecon-E-P Ds6-0 Firmware, Sprecher-Automation Sprecon-E-T3 Firmware, Sprecher-Automation Sprecon-E-Tc Ax-3110 Firmware.

How do I fix CVE-2022-4332?

No fix has been published for CVE-2022-4332 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-4332 being exploited?

There is no known exploitation of CVE-2022-4332 in the wild and no public exploit code.

Other vulnerabilities in Sprecher Automation SPRECON-E-C/P/T3 CPU PU244x

• CVE-2025-41742 Hardcoded credentials in SPRECON-E-C Critical 9.8
• CVE-2022-4333 Sprecher: Sprecon maintenance access with hardcoded credentials Critical 9.8
• CVE-2025-41744 Sprecher Automation: SPRECON-E series has static default key material for TLS connections Critical 9.1
• CVE-2024-6758 Improper Privilege Management vulnerability in Sprecher Automation SPRECON-E Medium 6.5
• CVE-2025-41743 Sprecher Automation: SPRECON-E series prone to weak encryption of update files Medium 4.0

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-73v7-m7qm-qq9g.